CC agentaudit-skill
Automatic security gate that checks packages against a vulnerability database before installation. Use before any npm install, pip install, yarn add, or package manager operation.
Not recommendedcritical or high security findings
As a process C 60/100 · Has gaps — weak spots: result and completion, consistency, running it twice
ProcedureAI and agentsInfrastructureSecuritytype and topics are labelled automatically from the skill text
What is at stake
The skill contains fragments that, in the wrong hands, cost money or data. Below: what the installer risks and what the author should do.
Secrets in code
If you install
The files contain someone else's key or token. If it is live, your agent will call third-party services under a stranger's identity; if it was revoked, the skill's scripts simply fail. Such a key often arrives with the author's whole workspace, personal data included.
For the author
The key is visible to everyone who downloaded the skill and has likely been copied by catalog-scanning bots already. Revoke it now, check bills and access logs, then reissue.
Dangerous commands medium severity
Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.
If you install
The skill contains commands that delete files, rewrite disks or execute code fetched from the network. The agent may run them without asking if it believes the instructions require it.
For the author
Replace destructive commands with safe equivalents that ask for confirmation, scope them to one folder, and stop piping curl into a shell: pin a version and a checksum.
How to improve
- Address the high-severity findings: each costs 18 safety points. If one is a false positive, add the rule id to guard.allow in spec.yaml.
For the model run — optional
- Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
- A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.
Guard findings · 31
-
high Secrets in code
meta-credential-filesconfig/credentials.jsonCredential / dotenv files bundled with the skill (1)config/credentials.json
Medium and low: 30
-
medium Dangerous commands
cmd-encoded-execreferences/AUDIT-METHODOLOGY.md:115Executes a base64/encoded payload (documentation table row; documentation of a security skill)| `OBF_B64_002` | Base…ode → execute chains | `atob()`, `base64 -d`, `b64decode()` followed by `eval`/`exec` |
tablesecurity skill -
medium Dangerous commands
cmd-encoded-execreferences/DETECTION-PATTERNS.md:63Executes a base64/encoded payload (documentation table row; documentation of a security skill)| `OBF_B64_002` | Base…ode → execute chains | `atob()`, `base64 -d`, `b64decode()` followed by `eval`/`exec` |
tablesecurity skill -
low Dangerous commands
cmd-pipe-to-shell-known-hostinstall.sh:5Pipe-to-shell installer from a well-known host (still executes remote code) (code comment)# curl -sSL https://raw.githubusercontent.com/starbuck100/agentaudit-skill/main/install.sh | bash
comment -
low Risky intent
intent-offensive-securityprompts/audit-prompt.md:69Offensive-security / dual-use content (legitimate for authorised testing; review intended use)- ABNORMAL: User input directly in shell strings without escaping, writing to system paths without explicit user action, unnecessary network calls, privilege escalation
-
low Risky intent
intent-offensive-securityprompts/audit-prompt.md:89Offensive-security / dual-use content (legitimate for authorised testing; review intended use)- ABNORMAL: Executable code, network calls, privilege escalation, wildcard permissions
-
low Risky intent
intent-offensive-securityprompts/audit-prompt.md:118Offensive-security / dual-use content (legitimate for authorised testing; review intended use)- Permission escalation + Persistence = **Persistent privilege escalation**
-
low Secrets in code
secret-password-literalprompts/audit-prompt.md:168Hard-coded password / key literal (may be an example)✅ TRUE POSITIVE: const API_KEY = "sk-l…eal" hardcoded in source.js → IS a finding
-
low Dangerous commands
cmd-privilegeprompts/audit-prompt.md:531Privilege escalation / world-writable permissions (documentation of a security skill)- **Privilege escalation** (`PRIV…001`): Unnecessary `sudo`, setuid, wildcard perms (`Bash(*)`).
security skill -
low Risky intent
intent-offensive-securityprompts/audit-prompt.md:531Offensive-security / dual-use content (legitimate for authorised testing; review intended use)- **Privilege escalation** (`PRIV…001`): Unnecessary `sudo`, setuid, wildcard perms (`Bash(*)`).
-
low Secrets in code
secret-high-entropy-tokenprompts/audit-prompt.md:604High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)1. **`John…yst`**: Multi-stage malware — `postinstall` downloads and executes remote payload, exfiltrates env vars to hardcoded webhook. Risk: 90. ✅ CRITICAL correct.
quoted -
low Dangerous commands
cmd-pipe-to-shell-known-hostREADME.md:63Pipe-to-shell installer from a well-known host (still executes remote code) (documentation of a security skill)curl -sSL https://raw.githubusercontent.com/starbuck100/agentaudit-skill/main/install.sh | bash
security skill -
low Dangerous commands
cmd-pipe-to-shell-known-hostREADME.md:70Pipe-to-shell installer from a well-known host (still executes remote code) (documentation of a security skill)curl -sSL https://raw.githubusercontent.com/starbuck100/agentaudit-skill/main/install.sh | bash -s -- --platform claude --agent my-agent
security skill -
low Risky intent
intent-offensive-securityREADME.md:285Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
-
low Risky intent
intent-offensive-securityreferences/AUDIT-METHODOLOGY.md:38Offensive-security / dual-use content (legitimate for authorised testing; review intended use)- `scripts/`: `curl|bash`, `eval`, `rm -rf`, credential harvesting
-
low Instruction override
en-role-hijackreferences/AUDIT-METHODOLOGY.md:82Role hijack ("from now on you must ignore… / developer mode") (documentation table row; documentation of a security skill)| `AI_P…003` | Capability Escalation | "enable developer mode", "unlock hidden capabilities", "activate god mode" |
tablesecurity skill -
low Dangerous commands
cmd-cron-mentionreferences/AUDIT-METHODOLOGY.md:101Mentions editing / listing crontab (documentation table row; documentation of a security skill)| `PERSIST_001` | Crontab modification | `crontab -e`, `crontab -l`, writing to `/var/spool/cron/` |
tablesecurity skill -
low Dangerous commands
cmd-background-processreferences/AUDIT-METHODOLOGY.md:104Starts a background / autostarted process (documentation table row; documentation of a security skill)| `PERSIST_004` | Systemd services | `systemctl enable`, writing to `/etc/systemd/`, `.service` files |
tablesecurity skill -
low Dangerous commands
cmd-persistencereferences/AUDIT-METHODOLOGY.md:105Persistence mechanism (cron / launchd / scheduled task / autorun registry) (documentation table row; documentation of a security skill)| `PERSIST_005` | macOS LaunchAgents | Writing to `~/Library/LaunchAgents/`, `/Library/LaunchDaemons/` |
tablesecurity skill -
low Risky intent
intent-offensive-securityreferences/DETECTION-PATTERNS.md:22Offensive-security / dual-use content (legitimate for authorised testing; review intended use)| `PRIV_ESC` | Privilege escalation |
-
low Instruction override
en-role-hijackreferences/DETECTION-PATTERNS.md:36Role hijack ("from now on you must ignore… / developer mode") (documentation table row; documentation of a security skill)| `AI_P…003` | Capability Escalation | "enable developer mode", "unlock hidden capabilities", "activate god mode" |
tablesecurity skill -
low Dangerous commands
cmd-cron-mentionreferences/DETECTION-PATTERNS.md:51Mentions editing / listing crontab (documentation table row; documentation of a security skill)| `PERSIST_001` | Crontab modification | `crontab -e`, `crontab -l`, writing to `/var/spool/cron/` |
tablesecurity skill -
low Dangerous commands
cmd-background-processreferences/DETECTION-PATTERNS.md:54Starts a background / autostarted process (documentation table row; documentation of a security skill)| `PERSIST_004` | Systemd services | `systemctl enable`, writing to `/etc/systemd/`, `.service` files |
tablesecurity skill -
low Dangerous commands
cmd-persistencereferences/DETECTION-PATTERNS.md:55Persistence mechanism (cron / launchd / scheduled task / autorun registry) (documentation table row; documentation of a security skill)| `PERSIST_005` | macOS LaunchAgents | Writing to `~/Library/LaunchAgents/`, `/Library/LaunchDaemons/` |
tablesecurity skill -
low Dangerous commands
cmd-pipe-to-shellreferences/REPORT-FORMAT.md:100Downloads and executes remote code from an unrecognised host (pipe to shell) (documentation table row; documentation of a security skill)| **Critical** | Exploitable now, immediate damage | `curl URL \| bash`, `rm -rf /`, env exfiltration, `eval` on raw input |
tablesecurity skill
A further 6 matches are quotations in this security skill's documentation and are not counted as findings.
Files scanned: 26. Evidence is masked. Grey chips explain why severity was lowered.
Against the Agent Skills spec
✓ No remarks against the Agent Skills spec
Process rating: all ten parameters 60/100
- 0Result and completion. Does not say what the result is
- 30Running it twice. 7 mutating operations with no state check
- 40Consistency. Frontmatter name (agentaudit-skill) differs from the folder (agentaudit)
- 50When it triggers. No condition that starts the skill
- 60Tools and files. Uses tools (bash, read, web, git, python, node) that frontmatter does not declare
- 70Inputs and preconditions. Inputs and preconditions are listed
- 70Execution cost. Instruction body is 4505 tokens
- 100Steps. 76 steps
- 100Failures and branches. 2 branches, has a failure section
- 100Progress reporting. Reports progress
- medium Safety rules and hard prohibitions inside a skill: they belong in the system prompt, here they protect nothing
- low 17 top-level sections: this looks like several domains in one skill
- low The response is described with custom markup (8 tags): a typed call is more reliable
Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.
Quality signals
- +5Description has no quoted example phrases that should trigger the skill
- +4Description does not say when NOT to use the skill (false activations)
- +3Output format is not stated: the model decides each time
- -241 emoji in the instructions: noise for the model
- -32 of 12 scripts are never mentioned in SKILL.md
- +1No license
- +2Single-language instructions
- +3Description length 179: enough signal without eating the budget
- +4Structure: 26 headings
- +3Step-by-step instructions: 76 items
- +4Has examples (11 code blocks)
- +4Reference files are cited in the instructions (6 of 6)
Quality base 70; lint remarks subtract, signals add up to 100. Result: 83.
External checks
ClawHub: suspicious
AgentAudit is a real security-gate tool, but it also persists and ships API credentials and can upload detailed audit reports to a remote registry, which users should review before installing.
LLM: suspicious (high) · VirusTotal: benign · 28 May 2026