Skills Audit

Security scanner that audits AI agent skill files before installation. Detects credential theft, data exfiltration, dangerous commands, and obfuscation using pattern matching. Everything runs locally — no data leaves your machine.

When to Use

Before installing any new skill or MCP server, scan it first. This catches embedded secrets, reverse shells, data exfiltration endpoints, obfuscated payloads, and other threats that hide in skill files.

How to Run

Three input modes:

Scan a local file

python scripts/scan.py --file /path/to/SKILL.md

Fetch and scan a remote skill by URL

python scripts/scan.py --url https://example.com/SKILL.md

Scan raw content directly

python scripts/scan.py --content "<paste skill text here>"

Output Format

JSON with risk score, severity level, findings, and recommendation:

{
  "scan_id": "a1b2c3d4-...",
  "risk_score": 75,
  "risk_level": "HIGH",
  "recommendation": "BLOCK",
  "findings": [
    {
      "type": "regex",
      "description": "AWS access key pattern detected",
      "severity": "HIGH",
      "evidence": "Matched Credential_AWS_Access_Key: AKIAIOSFODNN7EXAMPLE"
    }
  ]
}

Decision Logic

Any finding with CRITICAL severity overrides to BLOCK regardless of total score.

What It Detects

37 detection patterns across 4 threat categories:

• Credential theft — AWS, GitHub, Stripe, OpenAI, Anthropic, Supabase, database connection strings, crypto private keys, and 30+ more secret formats
• Data exfiltration — Discord/Slack/Telegram webhooks, paste services, file drop services, HTTP client POST calls, DNS tunneling
• Dangerous commands — Reverse shells, system destruction, privilege escalation, container escape, SSH key injection, PowerShell execution, deserialization attacks
• Obfuscation — Base64 decode chains, hex encoding, eval+encoding combos, string concatenation evasion, unicode escape sequences

For the full pattern list, see references/DETECTION-COVERAGE.md.

Privacy

Everything runs locally. The --file and --content modes make zero network requests. The --url mode fetches only the specified URL (5s timeout, 100KB limit) and processes it locally. No data is sent to any external service.