AI Skill Safety Audit

What it does

Inspect a local skill folder or ZIP for potential destructive operations, process execution, dynamic code, download-to-execution pipelines, encoded content, credential access, network endpoints, persistence, privilege changes, and package lifecycle hooks. A Python scanner covers Python, Node.js, ShellScript, cmd, and PowerShell source plus hostile SKILL.md and README instructions. Findings include masked path:line evidence, severity, confidence, explanations, and manual-review guidance in JSON or Markdown.

How to use

Keep the candidate disabled. Run the included scanner against a stable local folder or ZIP, then use the rule reference and manual checklist to review findings. Reports print to stdout; save them outside the input if needed. Included offline tests use inert strings and sentinel checks rather than running candidate payloads.

Requirements

Python 3.10 or later and its standard library only. The Python scanner reads all five target types: Python, Node.js, ShellScript, cmd, and PowerShell. No Node.js, shell, cmd, or PowerShell runtime or dependency installation is required.

Caveats

The scanner never executes or imports candidate code, installs packages, makes network requests, or extracts archives. Source-line snippets are entirely withheld to avoid credential disclosure. Links, unsafe paths, encrypted ZIPs, nested archives, suspicious compression, and budget violations trigger manual review or refusal. Lexical patterns have false positives and false negatives; no dataflow or malicious-intent inference is made. A network endpoint is not proof of exfiltration, and no matched indicators is not a safety certification. Free under the MIT license.