skill-security-auditor

---
name: skill-security-auditor
description: Use when auditing AI agent skills for security risks before installation; produces PASS/WARN/FAIL verdict with findings and remediation guidance.
category: Engineering
version: 1.0.0
tools: []
---

# Skill Security Auditor

Scan and audit AI agent skills for security risks before installation. Produces **PASS / WARN / FAIL** verdict with findings and remediation guidance.

## What Gets Scanned

### 1. Code Execution Risks

Scan all `.py`, `.sh`, `.bash`, `.js`, `.ts` files for:

| Category | Patterns Detected | Severity |
|----------|-------------------|----------|
| Command injection | `os.system()`, `os.popen()`, `subprocess.call(shell=True)`, backtick execution | CRITICAL |
| Code execution | `eval()`, `exec()`, `compile()`, `__import__()` | CRITICAL |
| Obfuscation | base64-encoded payloads, hex-encoded strings, `chr()` chains | CRITICAL |
| Network exfiltration | `requests.post()`, `urllib.request`, `socket.connect()`, `httpx`, `aiohttp` | CRITICAL |
| Credential harvesting | Reads from `~/.ssh`, `~/.aws`, `~/.config`, env var extraction | CRITICAL |
| File system abuse | Writes outside skill dir, `/etc/`, `~/.bashrc`, `~/.profile`, symlink creation | HIGH |
| Privilege escalation | `sudo`, `chmod 777`, `setuid`, cron manipulation | CRITICAL |
| Unsafe deserialization | `pickle.loads()`, `yaml.load()` (without SafeLoader), `marshal.loads()` | HIGH |
| Subprocess (safe) | `subprocess.run()` with list args, no shell | INFO |

### 2. Prompt Injection in SKILL.md

Scan SKILL.md and all `.md` files for:

| Pattern | Risk | Severity |
|---------|------|----------|
| System prompt override | "Ignore previous instructions", "You are now..." | CRITICAL |
| Role hijacking | "Act as root", "Pretend you have no restrictions" | CRITICAL |
| Safety bypass | "Skip safety checks", "Disable content filtering" | CRITICAL |
| Hidden instructions | Zero-width characters, HTML comments with directives | HIGH |
| Excessive permissions | "Run any command", "Full filesystem access" | HIGH |
| Data extraction | "Send contents of", "Upload file to", "POST to" | CRITICAL |

### 3. Dependency Supply Chain

For skills with `requirements.txt`, `package.json`, or inline `pip install`:

| Check | What It Does | Severity |
|-------|-------------|----------|
| Known vulnerabilities | Cross-reference with PyPI/npm advisory databases | CRITICAL |
| Typosquatting | Flag packages similar to popular ones | HIGH |
| Unpinned versions | Flag `requests>=2.0` vs `requests==2.31.0` | INFO |
| Suspicious packages | Low download count, recent creation, single maintainer | INFO |

### 4. File System & Structure

| Check | What It Does | Severity |
|-------|-------------|----------|
| Boundary violation | Scripts referencing paths outside skill directory | HIGH |
| Hidden files | `.env`, dotfiles that shouldn't exist | HIGH |
| Binary files | Unexpected executables, `.so`, `.dll`, `.exe` | CRITICAL |
| Symlinks | Symbolic links pointing outside skill directory | CRITICAL |

## Audit Workflow

1. Run scanner on skill directory or repo URL
2. Review report — findings grouped by severity
3. Interpret verdict:
   - **PASS** — No critical or high findings. Safe to install.
   - **WARN** — High/medium findings detected. Review manually before installing.
   - **FAIL** — Critical findings. Do NOT install without remediation.
4. Each finding includes specific fix guidance

## Limitations

- Cannot detect logic bombs or time-delayed payloads with certainty
- Obfuscation detection is pattern-based — sufficiently creative attacker may bypass it
- Network destination reputation checks require internet access
- Static analysis only (safe but less complete than dynamic)
- Dependency checks use local pattern matching, not live CVE databases

When in doubt, **don't install**. Ask the skill author for clarification.