Now liveThe Skillselion MCP - thousands of ranked skills, loaded into your agent mid-task. No install.Get it →
f4ah6o avatar

Skill Check Skill

  • Updated January 26, 2026
  • f4ah6o/skills-bonsai

skill-check-skill is a security guardrail that scans GitHub repositories for malicious code, destructive commands, and data-exfiltration patterns, recursively analyzing referenced scripts to catch threats hidden behind the main skill file. A user runs it before adding any new skill or tool.

Key points

  • Scans GitHub skill repos
  • Detects destructive commands
  • Recursively analyzes referenced scripts
  • Pre-install safety guardrail

Skill Check Skill by the numbers

  • Data as of Jul 7, 2026 (Skillselion catalog sync)
/plugin marketplace add f4ah6o/skills-bonsai
/plugin install skill-check-skill@skills-bonsai

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

Listed on Skillselion
Last updatedJanuary 26, 2026
Repositoryf4ah6o/skills-bonsai

What it does

Scan GitHub skill repos for malicious code, destructive commands, and data-exfiltration patterns before installing.

README.md

Skills BONSAI

A curation repository of skills

Acknowledgement

Maintenance

This repository includes a script to check if 3rd-party skills are up-to-date with their upstream repositories.

How it works

The script reads .claude-plugin/marketplace.json and checks plugins that have the x-installed-sha field defined. It compares the locally tracked commit SHA (x-installed-sha) with the latest commit on the upstream repository (derived from author.url).

Usage

Local Check:

Prerequisites: jq and gh (GitHub CLI) must be installed.

./scripts/check_updates.sh

GitHub Actions:

The check runs automatically every Monday via a GitHub Action workflow defined in .github/workflows/check_updates.yml. You can also trigger it manually from the "Actions" tab.

Adding a new tracked skill

To track a new skill, ensure the author.url points to the GitHub repository and add tracking fields to its entry in .claude-plugin/marketplace.json:

{
  "name": "your-skill",
  "author": {
      "name": "author-name",
      "url": "https://github.com/owner/repo"
  },
  ...
  "x-installed-sha": "CURRENT_SHA_HASH",
  "x-installed-date": "YYYY-MM-DDTHH:MM:SSZ"
}

Related skills

Securityauditappsec

This week in AI coding

Five minutes, every Monday - the tools, releases and tactics for developers.

unsubscribe anytime.