skill-security-audit
Installation
SKILL.md
Skill Security Audit
Overview
Review a third-party Agent Skill, MCP server, connector, or desktop extension before installation. The default workflow is read-only: do not install dependencies, execute project code, sign in, provide credentials, or connect the project to a real account during static review.
When to Use This Skill
- Use before installing an unfamiliar Skill, MCP server, connector, plugin, or desktop extension.
- Use when a project handles files, credentials, browser sessions, external accounts, network requests, or destructive actions.
- Use when a release, binary, dependency, or remote installer cannot be independently verified.