skill-auditor
Installation
SKILL.md
Audit an agent skill before it is installed. Answer two questions, and report them separately so a style nit never buries a security finding:
- Security — is it safe to install?
- Quality — does it conform to the spec, and will it work well?
Skill to audit: $ARGUMENTS
Do not invent a checklist. Work from these sources, and link them in the report:
- Anthropic — Skills for enterprise: risk tiers and review checklist — the spine of the security pass.
- Anthropic — Agent Skills security considerations
- OWASP Agentic Skills Top 10 — tag each security finding with its AST ID: AST01 Malicious Skills, AST02 Supply Chain Compromise, AST03 Over-Privileged Skills, AST04 Insecure Metadata, AST05 Untrusted External Instructions, AST06 Weak Isolation, AST07 Update Drift, AST08 Poor Scanning, AST09 No Governance, AST10 Cross-Platform Reuse.
- agentskills.io specification — format conformance.
- Anthropic — Checklist for effective Skills — the quality pass.