Skill Security Scanner Pro

Problem

When uploading or distributing .skill files, risky content may hide in file bodies, referenced documents, and script parameters. High-risk patterns are not always obvious, line-level issues can be missed in manual review, and fixes still need proof that the skill remains usable. This skill turns security scanning, remediation advice, optional auto-fix, and smoke testing into a reviewable workflow.

How It Works

• Scan: Read a .skill file and run scripts/scan_skill.py. Results include file path, line number, risk type, and suggested fix; references/security_patterns.md helps identify risk patterns.
• Assess: The agent evaluates severity and uses references/fix_strategies.md to produce a remediation report.
• Fix: Run scripts/fix_security_issues.py with --auto-fix when appropriate. Backups are created before scripted actions, and failed fixes can be rolled back.
• Verify: Use scripts/smoke_test.py against the patched skill directory, then repackage and return the updated .skill file.

Boundaries

It is useful for pre-upload checks, audits, or follow-up after a suspected issue. High-risk items require human confirmation and are not automatically fixed. Scripts execute precise changes while the agent makes risk and strategy decisions, so logs and smoke-test reports should still be reviewed before shipping.