skill-audit@1.0.3
CAUTION· install onlyPublisher claims: "Audits agent skills for prompt injection, hidden instructions, data exfiltration, and supply-chain risk before install and after updates. Use when vetting or scanning a skill from a registry, repo, or pasted folder, deciding whether a skill is safe to install or trust, diff-auditing a skill update, sweeping everything installed, verifying a package or publisher name against typosquats, or when the agent behaved oddly and a skill may explain it. Covers stealth language, undeclared endpoints or paths, obfuscated and encoded payloads, malicious scripts, and compromised-skill incident response. Not for auditing application source code or judging whether a skill is useful." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-10 and scored it 64/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Pipe-to-shell pattern; Prompt injection attempt; Host or command assembled from base64 fragments. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
…user again", scoped to a declared action. 3. **Execution reaches trust zero.** `curl | sh`, `base64 -d | sh`, `eval` on built strings, install scripts fetched at runtime, or code the skil…Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.…. 5. **Instructions to the agent about the agent are the highest-risk class.** "Ignore previous instructions", "run this at every session start", "add this to memory", "modify other skills…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.…scoped to a declared action. 3. **Execution reaches trust zero.** `curl | sh`, `base64 -d | sh`, `eval` on built strings, install scripts fetched at runtime, or code the skil…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.| Reads of `~/.ssh`, `~/.aws`, `.env`, browser profiles, wallets | Credential-harvesting scope | Reject when paired with any network sink (`exfiltration.md`) |Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.- "Ignore previous instructions", "this skill takes precedence over all others", "consult this before any other skill or rule".Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.…, not the framing. ## Persistence Grabs - "Run this at every session start", "add to your memory/CLAUDE.md/AGENTS.md", "create a cron job/hook/scheduled task", "save this as a global rule". A skil…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.| Reads of `~/.ssh`, `~/.aws`, `.env`, browser profiles, wallets | Credential-harvesting scope | Reject when paired with any network sink (`exfiltration.md`) |Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.pаypalFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.…user again", scoped to a declared action. 3. **Execution reaches trust zero.** `curl | sh`, `base64 -d | sh`, `eval` on built strings, install scripts fetched at runtime…Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
16 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Text that tells the agent to ignore its instructions≈ +9 on the totalDelete phrases like "ignore previous instructions", "override", "bypass" from SKILL.md and tool descriptions. Describe what the skill does; do not instruct the agent about other rules.
- Unclaimed publisher≈ +8 on the totalClaim ivangdavila: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Obfuscated code≈ +5 on the totalRemove base64-assembled strings, eval of decoded text and minified blobs. Reviewers and scanners both treat unreadable code as hostile.
- Pipe-to-shell pattern≈ +4 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- Host or command assembled from base64 fragments≈ +4 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
- Reads credential paths from the home directory≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.