skill-scanner
From the author
Scan agent skills for security issues. Use when asked to "scan a skill", "audit a skill", "review skill security", "check skill for injection", "validate SKILL.md", or assess whether an agent skill is safe to install. Checks for prompt injection, malicious scripts, excessive permissions, secret exposure, and supply chain risks.
Install
npx skills add getsentry/skills --skill skill-scanner -a claude-code
Installs to .claude/skills/skill-scanner/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
- Reads credential files such as ~/.ssh or ~/.awsLow
- Ships scripts we have not reviewedLow
Why 86
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- skill-security-auditoreigent-ai/eigentSecurity auditing for code, configs, and infrastructure. Use when the user wants to audit or improve security: scan for vulnerabilities (SQL injection, XSS, command injection, path traversal), detect hardcoded secrets and credentials, review auth and authorization, check dependencies for known CVEs, audit config files for insecure defaults, or generate security reports. Trigger on "security audit", "vulnerability scan", "code review for security", "find secrets", "check for vulnerabilities", "OWASP", "CVE", or questions about code security.Security★ 15.6K
- skill-inspectorNVIDIA/SkillSpectorReview AI agent skills before installation using NVIDIA SkillSpector and source-aware semantic review. Use when asked whether a skill or downloaded skill folder is safe, trustworthy, installable, over-permissioned, or malicious.Engineering★ 20.9K
- ai-securityborghei/Claude-SkillsThis skill should be used when the user asks to "scan AI systems for security threats", "check for prompt injection vulnerabilities", "assess model security posture", "detect data poisoning risks", or "audit AI/ML pipeline security".Security★ 962
- skill-vettingmohitagw15856/pm-claude-skillsVet an agent skill before installing it — read the SKILL.md and any scripts for the red-flag patterns (credential access, obfuscation, exfiltration, prompt injection), audit its blast radius, and produce a risk-tiered verdict. Use when asked is this skill safe to install, vet this SKILL.md, review this skill from a marketplace, or check what this skill can do to my machine. Produces the risk classification with quoted evidence, the permission-surface audit, the red-flag checklist results, and an install/sandbox/reject recommendation.Engineering★ 1.5K
- skill-injection-defenselawve-ai/awesome-legal-skillsAudits legal AI skills, prompts, workflows, MCP/tool instructions, and agent packages for prompt injection, malicious instructions, unsafe scripts, suspicious metadata, credential exposure, exfiltration paths, persistence mechanisms, and supply-chain risk. Use before installing, importing, publishing, promoting, modifying, or trusting third-party or generated AI skills and legal workflows. Do not use as a generic code review unless skill trust, workflow safety, prompt injection, or supply-chain hygiene is in scope.Legal★ 888
- skill-creatoranthropics/skillsCreate new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.OfficialTesting★ 182.9K
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in