domains / families / security / skill-security-audit

skill-security-audit

authentic

Audit an Agent Skill, MCP server, connector, or desktop extension before installation by tracing code, dependencies, permissions, credentials, data flow, and irreversible actions.

When to use

• Use before installing an unfamiliar Skill, MCP server, connector, plugin, or desktop extension.
• Use when a project handles files, credentials, browser sessions, external accounts, network requests, or destructive actions.
• Use when a release, binary, dependency, or remote installer cannot be independently verified.

When not to use

• The audit is evidence-led but bounded by the public revision and files that can be inspected.
• A missing policy or undocumented data destination remains unresolved; it must not be silently inferred away.
• Risk severity depends on capability, exposure, control, and reversibility, not on keywords alone.

Skill page

Source