Security Auditor

Audit skills for security risks before installing or using them.

Purpose

Skills can request permissions and access that may be:

• - Overreaching (accessing data they shouldn't need)
• Suspicious (behaving oddly, phoning home, etc.)
• Outdated (known vulnerabilities in dependencies)

This skill helps you audit them.

When to Run

Audit Workflow

Step 1: Quick Scan

CODEBLOCK0

Checks:

• - File access patterns
• Network access requests
• Suspicious API usage
• Permission requests

Step 2: Detailed Audit

CODEBLOCK1

Performs deep analysis:

• - Code pattern analysis
• Dependency checking
• Permission mapping
• Risk scoring

Step 3: Generate Report

CODEBLOCK2

Creates detailed security report.

Step 4: Compare Skills

CODEBLOCK3

Compare security posture of two skills.

Risk Levels

Red Flags to Watch For

File Access

• - Accessing ~/.ssh/ or INLINECODE1
• Reading *password*, *secret*, *key* files
• Writing to system directories
• Accessing other users' directories

Network

• - Exfiltrating data to unknown servers
• DNS rebinding patterns
• Encrypted payloads to unfamiliar domains

Permissions

• - Requesting exec with no scope limitation
• Reading memory or process info
• Keylogging or screenshot capabilities
• Accessing other installed skills' data

Code Patterns

• - Obfuscated code
• Dynamic code generation
• Shell commands without sanitization
• Credential harvesting patterns

Files

• - scripts/audit.py — Main audit script
• INLINECODE6 — Skill-specific scanner
• INLINECODE7 — Security rules and patterns
• INLINECODE8 — Permission reference guide