Skills-Security-Check — Claude Code skill: audit skills for risks
Scans a folder of skills, flags suspicious patterns with static analysis, then has the agent sort out false positives. Useful before you install someone else's skill.
npx skills add Toolsai/Skills-Security-Check --skill skills-security-check -a claude-codeWhat Skills-Security-Check does
The skill runs python3 scripts/scan_skills.py --root /path/to/target/projects. The script matches dangerous patterns with regex and drops *_audit_prompt.txt files into reports/YYYYMMDD.../prompts/, one per skill. Then the agent takes over: it reads those prompts, filters out false positives and writes an audit.json for each skill.
After that you run the scanner again. It picks up the finished audit.json files and builds reports/YYYYMMDD_HHMMSS/index.html, which opens on its own. The report shows a risk level plus the context the agent added.
The scanner never executes code and does not print raw secrets — only file paths and categories. Regex matching produces plenty of false positives, so skipping the analysis step leaves you with a noisy report. Add --json /path/to/output.json if you also want machine-readable output.
What it helps with
- check third-party skills before installing them
- filter false positives from a static scanner
- produce an HTML report across every skill in a folder
- spot skills that need an API key or touch secrets
- get audit results as machine-readable JSON
Example prompts for the agent
- Audit my skills for security risks
- Scan the skills folder and work through the audit prompts
- Run the skills audit and show me the dashboard
How to install Skills-Security-Check
1Skills CLI (Vercel)
npx skills add Toolsai/Skills-Security-Check --skill skills-security-check -a claude-code2Manually: put the files in place
~/.claude/skills/skills-security-check/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/skills-security-check/
1Skills CLI (Vercel)
npx skills add Toolsai/Skills-Security-Check --skill skills-security-check -a codex2Manually: put the files in place
.agents/skills/skills-security-check/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add Toolsai/Skills-Security-Check --skill skills-security-check -a cursor2Manually: put the files in place
.cursor/skills/skills-security-check/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install Toolsai/Skills-Security-Check skills-security-check2Manually: put the files in place
.github/skills/skills-security-check/SKILL.md1Skills CLI (Vercel)
npx skills add Toolsai/Skills-Security-Check --skill skills-security-check -a gemini-cli2Platform CLI
gemini skills install https://github.com/Toolsai/Skills-Security-CheckManually: put the files in place
.devin/skills/skills-security-check/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add Toolsai/Skills-Security-Check --skill skills-security-check -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about Skills-Security-Check
How do I install Skills-Security-Check in Claude?
Run npx skills add Toolsai/Skills-Security-Check --skill skills-security-check -a claude-code. The skill file then lands at ~/.claude/skills/skills-security-check/SKILL.md.
What does Skills-Security-Check do?
It runs a static pass over a folder of skills, generates audit prompts for the agent, and assembles an HTML dashboard with risk levels. The agent filters false positives and adds context in between.
Does it need Python?
Yes, the scanner runs as python3 scripts/scan_skills.py. Without Python the analysis and report steps never happen.
