Security audit
Security checks across malware telemetry and agentic risk
This is a broad skill-management toolkit, but it ships and can register persistent hook behavior that is wider and more environment-specific than a typical user would expect.
Install only if you want a powerful local skill-management toolkit and are comfortable reviewing commands before execution. Be especially careful with /skill-kit trigger compile, dedup cleanup, convert, merge, and upgrade workflows because they can modify persistent Claude settings, hooks, installed skills, backups, and git state. Prefer dry-run or single-skill scopes where available, and inspect generated hook scripts before registering them.
find ~/.claude/skills -name "SKILL.md" ! -path "*.bak*" -exec sh -c \
'head -10 "$1" | grep -q "^name:" || echo "name missing: $1"' _ {} \;
find ~/.claude/skills -name "SKILL.md" ! -path "*.bak*" -exec sh -c \
'head -10 "$1" | grep -q "^description:" || echo "description missing: $1"' _ {} \;
# Invalid fields'head -10 "$1" | grep -q "^description:" || echo "description missing: $1"' _ {} \;
# Invalid fields
grep -r "^triggers:" ~/.claude/skills --include="SKILL.md" | grep -v ".bak"
grep -r "^tools:" ~/.claude/skills --include="SKILL.md" | grep -v ".bak"
# Frontmatter position (must start on line 1)# Invalid fields grep -r "^triggers:" ~/.claude/skills --include="SKILL.md" | grep -v ".bak" grep -r "^tools:" ~/.claude/skills --include="SKILL.md" | grep -v ".bak" # Frontmatter position (must start on line 1) find ~/.claude/skills -name "SKILL.md" ! -path "*.bak*" -exec sh -c \
## Scan Paths 1. `~/.claude/skills/` - Personal skills 2. `~/.claude/plugins/marketplaces/*/plugins/*/skills/` - Plugin skills 3. `.claude/skills/` - Project skills ## Validation Rules
# Single skill skills-ref validate ~/.claude/skills/<skill-name> # All personal skills for d in ~/.claude/skills/*/; do [ -f "$d/SKILL.md" ] || continue echo "=== $(basename "$d") ==="
find ~/.claude/skills -name "SKILL.md" ! -path "*.bak*" -exec sh -c \
'head -10 "$1" | grep -q "^name:" || echo "name missing: $1"' _ {} \;
find ~/.claude/skills -name "SKILL.md" ! -path "*.bak*" -exec sh -c \
'head -10 "$1" | grep -q "^description:" || echo "description missing: $1"' _ {} \;
# Invalid fields# VENDOR_PAT escapes the leading dot so the bare `grep -nE "$VENDOR_PAT"` body scan matches `.ralph/` etc. VENDOR_PAT='\.ralph/|\.omc/|\.codex/|\.ai/' for skill_dir in ~/.claude/skills/*/ ~/.agents/skills/*/; do skill_name=$(basename "$skill_dir") skill_md="$skill_dir/SKILL.md" [ -f "$skill_md" ] || continue
bash -n ~/.claude/hooks/trigger-*.sh # Check settings.json parsing jq . ~/.claude/settings.json > /dev/null # Print trigger list /skill-kit trigger list
**Before (manual):** 1. Add trigger keywords to cleanup/SKILL.md description 2. Write a separate script in ~/.claude/hooks/ 3. Manually register in ~/.claude/settings.json **After (declarative):** 1. Add triggers to cleanup/SKILL.md:
#### Self-check (before entering Step 6) 1. Run the `jq` published.json query for `<skill-name>` — was it present? 2. **If jq returned empty: verify the path itself**. Run `[ -f "$PUB_JSON" ] && echo OK || echo MISSING`. If `MISSING`, run `find ~/.claude/skills/es6kr ~/.agents/skills/es6kr -name "published.json"` to relocate. **Do not classify as "Not in published.json" until you have confirmed the file actually exists at the queried path.** 3. Run `git -C ~/.agents ls-files skills/<skill-name>/` — was there at least one tracked file? 4. If jq returned empty but the file is missing/unreachable AND the skill is tracked AND `git -C ~/.agents remote get-url origin` matches the canonical public repo (`es6kr/skills`) → apply the **Public-repo fallback** row → classify as **Public**. 5. Map the answers onto the scope matrix
#### Self-check (before entering Step 6) 1. Run the `jq` published.json query for `<skill-name>` — was it present? 2. **If jq returned empty: verify the path itself**. Run `[ -f "$PUB_JSON" ] && echo OK || echo MISSING`. If `MISSING`, run `find ~/.claude/skills/es6kr ~/.agents/skills/es6kr -name "published.json"` to relocate. **Do not classify as "Not in published.json" until you have confirmed the file actually exists at the queried path.** 3. Run `git -C ~/.agents ls-files skills/<skill-name>/` — was there at least one tracked file? 4. If jq returned empty but the file is missing/unreachable AND the skill is tracked AND `git -C ~/.agents remote get-url origin` matches the canonical public repo (`es6kr/skills`) → apply the **Public-repo fallback** row → classify as **Public**. 5. Map the answers onto the scope matrix
|-----------|-----------| | `name` | Keep as-is (suffix removal recommended) | | `description` | Add triggers keywords | | `tools` | Remove (skills use all tools by default) | | `model` | Keep (optional) | | Script references | Copy to `scripts/` folder, change to relative paths |
Follow the [writer.md](./writer.md) guide to create the skill structure: 1. Create folder: `mkdir -p ~/.claude/skills/<skill-name>/scripts` 2. Write SKILL.md (frontmatter + body) 3. Copy scripts and `chmod +x` ### 4. Move Original
VirusTotal findings are pending for this skill version.
Detected: suspicious.dangerous_exec