Zhongkui Skill Security Auditor

The Problem: Trust Gaps in the AI Agent Ecosystem

In the Skill-based Agent ecosystem, installing third-party components is akin to plugging unknown modules into a system. A seemingly harmless Skill might contain prompt injection directives, credential stealing code, or covert data exfiltration channels. Traditional static scanning or manual review often fails to capture these hybrid risks, particularly behavioral-level vulnerabilities driven by LLMs. Developers and operations teams need a systematic tool to automatically assess a Skill's security posture before installation.

Core Mechanism: A Layered Audit Framework

Zhongkui.skill provides a defense-in-depth framework with the following workflow:

1. Layer 1: Static Checklist Audit: It performs a static scan of SKILL.md, scripts/, and dependency files against a checklist of 54 rules. This layer identifies fundamental risk patterns (R1-R12) including malicious code execution, privilege escalation, and obfuscated code. Any Skill triggering a "one-vote veto" item (e.g., eval() on external input) is directly ruled malicious, terminating the audit.

2. Layer 2: Behavioral Emulation Assessment: Triggered when static auditing detects potential high-risk items, this layer aims to detect behavioral vulnerabilities like R8 Covert Instructions and R11 External Information Source Poisoning by simulating tool invocation chains. It incorporates specialized tests for red team adversarial tactics and agent behavioral vulnerabilities.

3. Layer 3: Supply Chain Tracing: For high-risk or first-time published Skills, this layer traces supply chain security across 10 dimensions, including publisher reputation, CVE dependencies, version changes, and community feedback, assessing the runtime behavior of dependencies.

The tool employs a dual-verification model of 54 checklist items + 21 behavioral scenarios. The audit adheres to strict scoring and adjudication rules, outputting a three-tier verdict: "Clean," "Suspicious," or "Malicious," and follows clear error handling principles to ensure failures are actively reported, not silently skipped.

Capability Boundaries and Considerations

• Audit ≠ Guarantee: The audit results are an automated assessment of known risk patterns, not an absolute security guarantee. For high-risk scenarios like finance, healthcare, or government, the tool's report should serve as the starting point for human review.
• Some Capabilities are In Development: Layer 2 (Behavioral Emulation) and Layer 3 (Supply Chain Tracing) are currently marked as "Planned," with core capabilities centered on Layer 1's static audit.
• Vulnerability Database Requires Manual Update: Its built-in patterns.json uses a two-tier structure: a manual base and an auto-incremental layer. The --update command fetches the latest threat intelligence from NVD and Seebug to maintain detection efficacy.