domains / families / agent-tooling / skill-audit

skill-audit

authentic

Pre-install security scanner for AI agent skills. 7.5% of 14,706 skills are malicious. Audit before you trust.

When to use

• Use when you're about to install a third-party skill from GitHub, ClawHub, or any registry
• Use when you want to verify a skill's security before adding it to your agent
• Use when the user says "install this skill" or "add this skill"
• Use when reviewing skills for potential security issues

When not to use

• This skill is a review framework, not a sandbox or malware scanner.
• It can miss novel obfuscation, private payloads, or risks outside the available repository contents.
• Always combine findings with maintainer judgment, pinned dependencies, least-privilege runtime controls, and environment-specific validation.

Skill page

Source