Now liveThe Skillselion MCP - thousands of ranked skills, loaded into your agent mid-task. No install.Get it →
toolsai avatar

Skills Security Check

toolsai/skills-security-check

  • 505 installs
  • 40 repo stars
  • Updated February 6, 2026
  • toolsai/skills-security-check

skills-security-check is a hybrid security auditing agent skill that scans directories of third-party skills with regex static analysis plus mandatory AI review to produce per-skill audit.json files and an HTML dashboard

About

skills-security-check from toolsai/skills-security-check is a hybrid static-and-AI security auditor for agent skill repositories. Developers run `python3 scripts/scan_skills.py --root /path/to/skills` to collect regex-based findings and generated audit prompts, then the agent must analyze every prompted skill and write audit.json files before re-running the scanner to bake results into `reports/YYYYMMDD_HHMMSS/index.html`. The scanner reports file locations and risk categories without echoing raw secrets and accepts optional `--json` output. Reach for skills-security-check when onboarding community skills, reviewing a skills marketplace checkout, or answering whether SKILL.md files contain credential leaks, network calls, obfuscation, or high-risk shell instructions before production agent environments execute them.

  • Credential and secret exposure detection
  • Unsafe shell and command pattern review
  • Malicious instruction triage
  • Third-party skill vetting workflow
  • Pre-install security gate for agent tooling

Skills Security Check by the numbers

  • 505 all-time installs (skills.sh)
  • +19 installs in the week ending Jul 27, 2026 (Skillselion tracking)
  • Ranked #505 of 2,203 Security skills by installs in the Skillselion catalog
  • Data as of Jul 27, 2026 (Skillselion catalog sync)
npx skills add https://github.com/toolsai/skills-security-check --skill skills-security-check

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

Listed on Skillselion
Installs505
repo stars★ 40
Last updatedFebruary 6, 2026
Repositorytoolsai/skills-security-check ↗

How do you audit third-party agent skills for malware?

Audit third-party agent skills for unsafe instructions, secret leakage, and malicious patterns before installing them in production agent environments.

Who is it for?

Platform engineers and agent maintainers who install community skills and need a repeatable static-plus-AI review pipeline with a visual HTML report.

Skip if: Runtime sandbox enforcement, scanning application source code unrelated to SKILL.md trees, or teams expecting fully automated verdicts without agent analysis of audit prompts.

When should I use this skill?

The user asks to audit, scan, or security-check a folder of agent skills before install or merge.

What you get

HTML security dashboard, optional JSON scan output, per-skill audit.json verdicts, and audit prompt files under reports/YYYYMMDD_HHMMSS/prompts/.

  • HTML security dashboard
  • per-skill audit.json
  • audit prompt text files

By the numbers

  • Uses a mandatory 3-step agentic workflow: scan, AI audit.json, rescan
  • Ships scripts/scan_skills.py as the main scanner entrypoint
  • Writes final HTML reports under reports/YYYYMMDD_HHMMSS/index.html

Files

SKILL.mdMarkdownGitHub ↗

Skill: Skills-Security-Check

CRITICAL INSTRUCTION FOR AI AGENTS: You are NOT just a command-runner. You are the Lead Security Analyst. This tool provides the data, but YOU provide the intelligence.

⚡️ The 3-Step Agentic Workflow (MANDATORY)

You MUST follow this loop whenever using this skill:

Step 1: Run the Scanner (Data Collection)

Execute the scanner to generate the raw data and "Audit Prompts".

python3 scripts/scan_skills.py --root /path/to/target/projects

This command will generate `_audit_prompt.txt files in the reports/YYYYMMDD.../prompts/` directory.*

Step 2: 🛑 MANDATORY AI ANALYSIS (CRITICAL)

The Scanner's job is done. Now YOUR job begins. You MUST process the generated audit prompts.

Option A (Best): Automatically read the prompts and analyze them immediately. Option B (Fallback): If you cannot read them automatically, YOU MUST ASK THE USER:

"Scanner finished. I see {N} audit prompts generated. Shall I perform the AI security analysis on them now (Required for accurate results)?"

Requirement:

  • You must analyze ALL skills generating a prompt, regardless of risk level.
  • Generate audit.json for each skill.

Step 3: Integrate & Present

Run the scanner ONE MORE TIME. It will detect your audit.json files and bake them into the final report.

python3 scripts/scan_skills.py --root /path/to/target/projects

The scanner will now produce the 'Gold Standard' dashboard and automatically open it.

---

Technical Details

  • Scanner Logic: Regex-based static analysis. High false-positive rate.
  • Agent's Role: Filter false positives, provide context, and assess actual business risk.
  • Output: reports/YYYYMMDD_HHMMSS/index.html (The final artifact for the user).

Example Scenario: User: "Audit my skills." Agent: 1. Runs scan_skills.py. 2. Sees zimage_audit_prompt.txt flagged "High Risk". 3. Reads the prompt, realizes it's just an API client. 4. Writes audit.json marking it "Medium Risk" (requires API key). 5. Re-runs scan_skills.py to finalize the dashboard.

How to run

1. Run the scanner on a root folder that contains multiple skills:

python3 /Users/mattchan/.agents/skills/skill-security-audit-dashboard/scripts/scan_skills.py \
  --root /Users/mattchan/.agents/skills \
  --out /Users/mattchan/.agents/skills/skill-security-audit-dashboard/security-dashboard.html

2. Open the generated HTML dashboard file to view the results.

Notes

  • This is a static heuristic scan. It does not execute code.
  • The scanner avoids outputting raw secrets. It only reports file locations and categories.
  • If you need a JSON file as well, pass --json /path/to/output.json.

Arguments

  • --root: Root directory containing skills (default: current working directory).
  • --out: Path to the output HTML dashboard.
  • --json: Optional path to write raw JSON output.

Related skills

microsoftEntra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kmicrosoftAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3kxixu-meOpenclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72better-authBetter Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206firebaseFirebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397squirrelscanAudit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85

How it compares

Use skills-security-check for SKILL.md supply-chain review with AI triage; use runtime policy hooks when you need to block tool execution live rather than pre-install auditing.

FAQ

What is the skills-security-check workflow?

skills-security-check requires three steps: run scripts/scan_skills.py to create audit prompts, have the agent read every prompt and write audit.json per skill, then rerun scan_skills.py so findings merge into reports/YYYYMMDD_HHMMSS/index.html.

Does skills-security-check execute skill code?

skills-security-check performs static heuristic scanning only and does not execute skill scripts. The scanner avoids printing raw secrets, reporting file paths and risk categories instead while the agent filters false positives.

Which command starts a skills-security-check scan?

skills-security-check starts with `python3 scripts/scan_skills.py --root /path/to/target/projects`. Optional flags include --out for HTML path and --json for raw JSON output alongside generated prompts under reports/.

Securityauditappseccompliance
Browse by category
AI & AgentsFrontend & DesignBackend & DataDev ToolsAutomationTesting & ReviewSecurityMonitoring & CloudDocs & Planning
Design & frontend
Design systemsAnimation & motionAccessibility (a11y)CSS & TailwindUI designUXDesign to codeshadcn/uiLanding pagesBest design skills
Most searched skills
find-skillscavemanfrontend-designbrainstormingsystematic-debuggingstop-slopemil-design-engui-ux-pro-maxkarpathy-guidelinesweb-design-guidelinesreact-best-practicesgrill-meimprovemicrosoft-foundryagent-browser
Browse all listings
All agent skillsAll MCP serversAll marketplacesAll plugins

This week in AI coding

Five minutes, every Monday - the tools, releases and tactics for developers.

unsubscribe anytime.