Skill Security Auditor

What this skill does

Audit an AI agent skill before installing it. Use proactively whenever the user is about to add, install, enable, or evaluate an unfamiliar skill, including phrases like "audit this skill", "is this skill safe", "scan skill before install", "check skill for malicious code", "review this plugin", or any pre-install gate on an untrusted, third-party, or community-distributed skill bundle. Runs ten categories of static checks (code execution, network exfiltration, credential harvesting, persistence, prompt injection, supply-chain hooks, obfuscation, destructive filesystem ops, secrets, Trojan Source / homoglyphs) and emits a PASS / WARN / FAIL verdict.

• Security
• Auditor

Where it runs, and how to install it

Agent Skills are a format, not a product feature: a folder with a SKILL.md and whatever files it needs. Nothing inside one is model-specific.

Claude

Drop the skill folder into ~/.claude/skills/, or upload it in Settings → Capabilities. Claude loads it when the description matches what you asked for.

Claude Code

Same folder, per-project instead: .claude/skills/ inside the repository, so the skill travels with the work rather than with the machine.

Any agent that reads SKILL.md

A skill is a folder with a SKILL.md and whatever files it needs. Nothing in the format is model-specific, so a runtime that reads the file reads the skill.

More from Antoine Louis

• Tabular ReviewGuide to analyze multiple documents (PDF, DOCX) against user-defined columns and produce a structured Excel output with citations. Use when the user wants to: (1) Extract specific information from multiple documents into a table, (2) Compare clauses or provisions across contracts, (3) Create a document review matrix with source citations.
• Word EditorEdit, query, and transform Word documents (.docx) with the SuperDoc CLI. Use when the user asks to read, search, modify, format, comment, track changes, or review changes in .docx files. Triggers on any task involving Word documents: text replacement, redlining, contract markup, template filling, bulk edits, content extraction, or document review.
• VS Code ExtensionBuild VS Code extensions from scratch or convert existing JS/React/Vue apps. Supports commands, webviews (React/Vue), custom editors, tree views, and AI agent integration via file-bridge IPC. Use when user wants to create a VS Code extension, convert a web app to an extension, add webviews or custom UIs to VS Code, implement tree views, build custom file editors, integrate with AI agents, or packa

Skills that do related work

• 🔐 Security Questionnaire Answer Drift AuditorCompare incoming security questionnaire answers with an approved library for stale evidence, scope mismatch, dropped citations and material wording drift.
• Credential Handling Safety ReviewerReview scripts and docs for safer handling of passwords, tokens, keys and sensitive values.
• Data Breach Response ManagerA structured response manager for personal data breaches, handling triage, timelines and notification decision support.
• Supplier Due Diligence PackCreates supplier due diligence questionnaires, third-party risk checks, onboarding summaries, approval notes, evidence requests, review schedules, risk ratings,
• 生成合同要点 · Contract Essentials BuilderDistill any contract into one essentials card: parties, amounts, terms, obligations and breach, with source locations, risk flags and open questions. The skill
• Security ReviewPerform language and framework specific security best-practice reviews and suggest improvements. Covers Python, JavaScript/TypeScript, and Go. Use when the user