An Agent Skill that audits the Agent Skills already installed on your machine.
It inventories every skill your harness can load, checks each one against 35 rules for security, trust, spec, cost, and quality problems, and hands back a graded report with quoted evidence and a concrete fix for every finding.
- Two passes, because one is not enough - deterministic rules catch the dangerous syntax, and a semantic reading pass catches manipulation written as ordinary prose, which is where most critical cases in the wild actually live.
- Read-only, and hostile content stays data - nothing belonging to an audited skill is ever executed, imported, or fetched. Text asking to be marked safe is quoted as evidence of injection, not obeyed.
- Obfuscation is decoded, not just noticed - the scanner decodes a level and re-runs its pattern set, so it reports that a blob decodes to a pipe-to-shell command rather than that a blob exists.
- A number on your context bill - every installed skill costs you tokens in every session, used or not. The report totals it per skill and per harness, since a session loads only the skills installed for the harness it is running.
- Precision counts as much as detection - a tool that flags ordinary skills trains you to ignore it, so clean controls in the eval suite exist purely to measure false positives.
- Measured, not asserted - the repo ships its own eval suite and CI gates on it. The skill also audits itself, grades A, and an invariant fails the build if that stops being true.
Install
npx skills add Peng-Wen/skill-audit -g
-g installs at the user level, which is the scope this skill wants.
It audits everything your machine can load, so pinning it to one project defeats the point.
Leave the flag off and the CLI asks which scope to use, except under -y, where it quietly picks the project.
Common variations:
# Target one harness instead of choosing from the ones the CLI detects
npx skills add Peng-Wen/skill-audit -g -a claude-code
# Install for several harnesses at once, sharing a single canonical copy
npx skills add Peng-Wen/skill-audit -g -a claude-code -a codex -a opencode
# Install into the current project instead, to commit alongside the repo
npx skills add Peng-Wen/skill-audit -a claude-code
# Unattended, for a dotfiles or CI setup script
npx skills add Peng-Wen/skill-audit -g -a claude-code -y
# Copy the files instead of symlinking them into each harness directory
npx skills add Peng-Wen/skill-audit -g --copy
# Install from a clone you have already read, rather than straight from GitHub
npx skills add ./skill-audit -g
The -a values are the skills CLI's own harness ids, such as claude-code, codex, opencode, cursor, and gemini-cli.
Where each one keeps its skills, and where this audit goes looking for them, is in harness notes.
Updating and removing take the skill name and the same scope flag you installed with:
npx skills update skill-audit -g
npx skills remove skill-audit -g -a '*'
Needs python3, standard library only.
Nothing else to install, and nothing to configure.
Other install paths, updating, and verifying the installed copy are in Installing.
Use
Ask for it in your own words.
There is no command to remember.
Audit my skills for anything malicious.
Are the skills I have installed safe?
How much context do my installed skills consume?
Check this before I install it: ~/Downloads/some-skill
You get back report.md, findings.json, and an interactive summary page you can filter and act on.
The scripts also run on their own, with no agent involved:
python3 skill-audit/scripts/scan_skill.py --skill ~/Downloads/some-skill --out findings.json
Documentation
- Why audit your skills - what the research actually found, and the context cost nobody measures.
- Installing - install, update, verify, and point it at non-standard paths.
- What it checks - the 35 rules, the grading scale, and two design choices worth knowing about.
- How it works - the five phases, the injection guardrail, and how the skill audits itself.
- What this cannot tell you - the honest ceiling on any static analysis of a Markdown file.
- Eval suite - six cases, thirteen fixtures, and the numbers behind the badges.
Reporting issues
Use the issue tracker.
Two kinds of report are especially useful:
- A false positive. A skill flagged for something it does not do. Precision is a design goal here, so these get fixed rather than argued with. Include the rule id and enough of the skill to reproduce it.
- A miss. Something dangerous that came back clean. If you can, propose it as an inert fixture in evals/fixtures/ with its ground truth, so the fix stays fixed.
Please do not attach real credentials, tokens, or private skill contents to an issue.
Fixture-style stand-ins reproduce almost anything, and the existing fixtures show the house style: hosts under *.example.invalid, fake secret strings, and every planted file labelled.
License
MIT. See LICENSE.
