Skill Safety Check

Problem

Before installing a third-party Agent skill, users often cannot tell what the code will actually do: whether it accesses the network, reads user files, executes a shell, or touches credentials. Traditional security reviews are engineering-heavy and too long for non-technical users to turn into a simple go/no-go decision.

How It Works

The skill turns review into a short workflow: run the bundled static scanner, then read simple_report, risk_level, and summary from the JSON output. It expands findings only when a higher rating needs explanation. Ratings are mapped to concrete behaviors:
- Low: docs only, or scripts that merely read user-provided files
- Medium: scripts, declared dependencies, purposeful network access, or local file reads
- High: shell execution, file writes/deletes, broad directory scans, environment variable reads, external APIs, or network plus shell
- Block: credential path reads, unknown exfiltration endpoints, obfuscated code, download-and-execute patterns, safety bypass instructions, destructive commands, or prompt-injection language

It checks .js, .py, .sh, .ps1, .bat, network calls such as fetch, curl, and wget, file access such as fs.readFile and unlink, process execution such as child_process, secrets and paths such as API_KEY, .env, .ssh, and .npmrc, and injection phrases like ignore previous instructions.

Limitations

The report is a concise, beginner-friendly conclusion such as “whether it uses the network” or “whether it touches local files,” not a full penetration test or legal compliance review. When the scanner flags suspicious items, reviewers should inspect file paths and line numbers; complex dependencies, runtime behavior, and business data risk still require manual code audit.