The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs users to install a package and clone a repository from an unverified source (https://github.com/huifer/skill-security-scan). This is a third-party dependency not associated with a known trusted vendor.
[REMOTE_CODE_EXECUTION]: The setup instructions for the security tool involve running pip install and pyinstaller on content downloaded from a remote repository, which results in the execution of third-party code during the installation process.
[COMMAND_EXECUTION]: The skill's documentation contains multiple examples of high-risk system commands, including rm -rf /, chmod 777 /etc/passwd, and reverse shell patterns such as nc -e /bin/bash. While these are presented as detection rules for the scanner, their presence in the instruction set involves handling dangerous executable strings.
[DATA_EXFILTRATION]: The documentation explicitly references sensitive system file paths, including SSH private keys (~~/.ssh/id_rsa), AWS credentials (~~/.aws/credentials), and .env files containing secrets. These paths are listed as targets for the scanner's detection capabilities.
[PROMPT_INJECTION]: The skill's primary function is to process and analyze other skills, which creates a surface for indirect prompt injection if the ingested data contains instructions designed to manipulate the scanner's behavior.
Ingestion points: Reads and analyzes files from directories such as .claude/skills/.
Boundary markers: No explicit delimiters or boundary markers are defined to separate untrusted skill content from the scanner's logic.
Capability inventory: The skill instructions reference capabilities for shell command execution (subprocess.run, os.system) and file system access.
Sanitization: The skill claims to perform static analysis, but no specific sanitization, escaping, or validation of the external content is documented.

skill-security-scanner