# Skills-Security-Check

Scans a folder of skills, flags suspicious patterns with static analysis, then has the agent sort out false positives. Useful before you install someone else's skill.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 593 installs · ★ 45
- Author: Toolsai
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/Toolsai/Skills-Security-Check/tree/HEAD/SKILL.md
- Updated: 2026-02-06
- HTML: https://affpapa.org/en/nevibecode/skills/skills-security-check

## What it does

The skill runs `python3 scripts/scan_skills.py --root /path/to/target/projects`. The script matches dangerous patterns with regex and drops `*_audit_prompt.txt` files into `reports/YYYYMMDD.../prompts/`, one per skill. Then the agent takes over: it reads those prompts, filters out false positives and writes an `audit.json` for each skill.

After that you run the scanner again. It picks up the finished `audit.json` files and builds `reports/YYYYMMDD_HHMMSS/index.html`, which opens on its own. The report shows a risk level plus the context the agent added.

The scanner never executes code and does not print raw secrets — only file paths and categories. Regex matching produces plenty of false positives, so skipping the analysis step leaves you with a noisy report. Add `--json /path/to/output.json` if you also want machine-readable output.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add Toolsai/Skills-Security-Check --skill skills-security-check -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/skills-security-check/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/skills-security-check/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add Toolsai/Skills-Security-Check --skill skills-security-check -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/skills-security-check/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add Toolsai/Skills-Security-Check --skill skills-security-check -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/skills-security-check/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install Toolsai/Skills-Security-Check skills-security-check
```

2. **Manually: put the files in place**
- File: `.github/skills/skills-security-check/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add Toolsai/Skills-Security-Check --skill skills-security-check -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/Toolsai/Skills-Security-Check
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/skills-security-check/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add Toolsai/Skills-Security-Check --skill skills-security-check -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/Toolsai/Skills-Security-Check/tree/HEAD/SKILL.md

## When to use it
- check third-party skills before installing them
- filter false positives from a static scanner
- produce an HTML report across every skill in a folder
- spot skills that need an API key or touch secrets
- get audit results as machine-readable JSON

## Example prompts
- Audit my skills for security risks
- Scan the skills folder and work through the audit prompts
- Run the skills audit and show me the dashboard

## Similar
- [owasp-security-check](https://affpapa.org/en/nevibecode/skills/owasp-security-check.md) — skill · 1700 installs
- [dependency-check](https://affpapa.org/en/nevibecode/skills/dependency-check.md) — skill · 748 installs
- [marketplace-health-check](https://affpapa.org/en/nevibecode/skills/marketplace-health-check.md) — skill · 389 installs
- [security-scan](https://affpapa.org/en/nevibecode/skills/jwynia-security-scan.md) — skill · 471 installs
- [audit-prep-assistant](https://affpapa.org/en/nevibecode/skills/audit-prep-assistant.md) — skill · 5700 installs
- [trailmark](https://affpapa.org/en/nevibecode/skills/trailmark.md) — skill · 4000 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md