skill-web-importer
Installation
SKILL.md
Purpose
Block malicious web-sourced skills before they enter the library. The 2026 ToxicSkills study found 36% of public AI agent skills contain prompt injection and 13.4% contain critical exploits including credential exfiltration and backdoor installation. This skill is the mandatory gate between web research and skill-maker.
Trigger
Auto-trigger in these situations:
- Claude uses
WebFetchto retrieve a SKILL.md from any external host - User says: "import skill from...", "adapt this skill I found", "use this from GitHub", "網路上找到的 skill"
- Any skill-maker invocation where the source is a URL (not original authoring)
Do NOT trigger for:
- Skills authored from scratch with no external source — use
skill-makerdirectly - Static analysis of already-installed local skills — use
skill-security-auditorinstead - General code security reviews — use
security-auditinstead