Bundled upstream support

Supporting files are included at skill-relative paths. See UPSTREAM-NOTICE.md for their pinned sources, licenses, hashes, and import changes.

Skill Security Scanner

Scan agent skills for security issues before adoption. Detects prompt injection, malicious code, excessive permissions, secret exposure, and supply chain risks.

Resolve this installed skill directory explicitly. Run the bundled helper with an already reviewed Python environment containing PyYAML; no repository-root working directory or implicit dependency download is required.

When to Use

• You need to evaluate a skill for prompt injection, malicious code, over-broad permissions, or supply-chain risk before adopting it.
• You want a static scan plus manual review workflow for a skill directory.
• The task is to decide whether a skill is safe enough to trust in an agent environment.

Bundled Script

scripts/scan_skill.py

Static analysis scanner that detects deterministic patterns. Outputs structured JSON (skill-scanner.locators.v2). It reports fixed finding descriptions, local file/line locators, counts, recognized tools and metadata field presence/types. It omits raw metadata values, source excerpts, decoded payloads, commands, symlink targets and complete URLs. Inspect those privately at the reported location. Relative filenames, the selected directory identifier and URL hostnames remain visible identifiers; the report is not an anonymizer for sensitive names. Unsupported inputs remain incomplete, not safe.

python3 "<installed-skill-dir>/scripts/scan_skill.py" "<authorized-inert-skill-directory>"

Returns JSON with findings, URL host/line locators, structure info, and severity counts. The script catches patterns mechanically — your job is to evaluate intent and filter false positives.

Scanner Coverage and Report Privacy

Use a private inert snapshot: this helper is static inspection, not an execution sandbox. It refuses final symlinks/non-regular files and bounds a file to 1 MiB, a tree to 1,000 files / 16 MiB. Hosts without guarded no-follow file opens report incomplete rather than silently following links. Nested regular text files are included; binary/unreadable inputs remain explicit coverage gaps. A scan error or incomplete coverage exits nonzero, not a clean pass.

Source payloads are omitted from the report rather than relying on recognition of every secret format. Visible filenames and hostnames can still be confidential identifiers; inspect reports locally before sharing. No target script, lifecycle hook, test or external URL is executed. Domain familiarity and lexical overlap do not satisfy semantic review or merge authority.

Workflow

Phase 1: Input & Discovery

Determine the scan target:

• If the user provides a skill directory path, use it directly
• If the user names a skill, look for it under plugins/*/skills/<name>/ or .claude/skills/<name>/
• If the user says "scan all skills", discover all */SKILL.md files and scan each

Validate the target contains a SKILL.md file. List the skill structure:

ls -la <skill-directory>/
ls <skill-directory>/references/ 2>/dev/null
ls <skill-directory>/scripts/ 2>/dev/null

Phase 2: Automated Static Scan

Run the bundled scanner:

python3 "<installed-skill-dir>/scripts/scan_skill.py" "<authorized-inert-skill-directory>"

Parse the JSON output. The script produces findings with severity levels, URL analysis, and structure information. Use these as leads for deeper analysis.

Fallback: If the script fails, proceed with manual analysis using Grep patterns from the reference files.

Phase 3: Frontmatter Validation

Read the SKILL.md and check:

• Required fields: name and description must be present
• Name consistency: name field should match the directory name
• Tool assessment: Review allowed-tools — is Bash justified? Are tools unrestricted (*)?
• Model override: Is a specific model forced? Why?
• Description quality: Does the description accurately represent what the skill does?

Phase 4: Prompt Injection Analysis

Load the installed skill's references/prompt-injection-patterns.md for context.

Review scanner findings in the "Prompt Injection" category. For each finding:

1. Read the surrounding context in the file

…