skill-scanner

Skill Scanner

Scan scripts, documents, and configuration in the Skill directory, and report risks such as credentials, private keys, dangerous commands, sensitive directory access, outbound downloads, and code obfuscation.

Trigger Scenarios

• Before introducing an external Skill.
• Before pushing a new Skill to a public repository.
• Perform regression checks after upgrading Skill dependencies or scripts.
• Review a user-uploaded Skill archive or local directory.

Security Boundaries

• Only read the target directory; do not execute the scripts being scanned, do not connect to the network, and do not install dependencies.
• The report contains only the risk type, severity level, relative file path, and line number; outputting matched code, Tokens, passwords, or private key contents is prohibited.
• reject indicates a critical risk was found;caution indicates a risk requiring manual review was found;approved only indicates that the current rules were not matched, and cannot replace manual review.
• Treat scan results as a pre-merge check, not as proof of security.

Usage

Execute in the Skill root directory:

python3 scripts/scan_skill.py path/to/skill
python3 scripts/scan_skill.py path/to/skill --json
python3 scripts/scan_skill.py path/to/skill --output report.md

Exit codes:0 indicates no issues were found,1 indicates review is needed,2 indicates a critical risk.

Standard Workflow

1. Read the target Skill's file list to confirm the scan scope.
2. Run both the Markdown report and JSON report modes.
3. Handle critical、highfirst, then determine whether medium is a clear business requirement.
4. Verify the relative paths and line numbers in the report; do not ask the tool to echo sensitive content.
5. After cleaning up or isolating the issues, rescan and save a report that does not contain sensitive values.

Rule Coverage

• Credential assignments, cloud keys, Tokens, passwords, and private key headers.
• /Users、/home, sensitive configuration directories, and host credential directories.
• Recursive deletion, privilege escalation, system persistence, reverse shells, and download-and-execute.
• eval、exec, dynamic imports, Base64/Hex/Marshal decoding, and other obfuscation signals.
• HTTP requests, package manager downloads, Sockets, and other outbound signals.

Limitations

Rule scanning may produce false positives and may also miss semantic-level attacks. For high-risk Skills, continue to perform manual code review, run with least privilege, and validate in an isolated environment.