Security audit
Security checks across malware telemetry and agentic risk
This appears to be a real skill-management toolkit, but it needs Review because it can persist hooks, install global skills, move/delete skill files, and commit repository changes with incomplete safeguards.
Install only if you are comfortable with a skill that can manage your local skill ecosystem. Before using it, review `scripts/trigger-compile.sh`, avoid unattended `-y` global installs, run trigger compilation in dry-run mode first, and confirm exact paths before backup deletion, agent conversion, hook registration, or git commit workflows.
find ~/.claude/skills -name "SKILL.md" ! -path "*.bak*" -exec sh -c \
'head -10 "$1" | grep -q "^name:" || echo "name missing: $1"' _ {} \;
find ~/.claude/skills -name "SKILL.md" ! -path "*.bak*" -exec sh -c \
'head -10 "$1" | grep -q "^description:" || echo "description missing: $1"' _ {} \;
# Invalid fields'head -10 "$1" | grep -q "^description:" || echo "description missing: $1"' _ {} \;
# Invalid fields
grep -r "^triggers:" ~/.claude/skills --include="SKILL.md" | grep -v ".bak"
grep -r "^tools:" ~/.claude/skills --include="SKILL.md" | grep -v ".bak"
# Frontmatter position (must start on line 1)# Invalid fields grep -r "^triggers:" ~/.claude/skills --include="SKILL.md" | grep -v ".bak" grep -r "^tools:" ~/.claude/skills --include="SKILL.md" | grep -v ".bak" # Frontmatter position (must start on line 1) find ~/.claude/skills -name "SKILL.md" ! -path "*.bak*" -exec sh -c \
## Scan Paths 1. `~/.claude/skills/` - Personal skills 2. `~/.claude/plugins/marketplaces/*/plugins/*/skills/` - Plugin skills 3. `.claude/skills/` - Project skills ## Validation Rules
# Single skill skills-ref validate ~/.claude/skills/<skill-name> # All personal skills for d in ~/.claude/skills/*/; do [ -f "$d/SKILL.md" ] || continue echo "=== $(basename "$d") ==="
find ~/.claude/skills -name "SKILL.md" ! -path "*.bak*" -exec sh -c \
'head -10 "$1" | grep -q "^name:" || echo "name missing: $1"' _ {} \;
find ~/.claude/skills -name "SKILL.md" ! -path "*.bak*" -exec sh -c \
'head -10 "$1" | grep -q "^description:" || echo "description missing: $1"' _ {} \;
# Invalid fields# VENDOR_PAT escapes the leading dot so the bare `grep -nE "$VENDOR_PAT"` body scan matches `.ralph/` etc. VENDOR_PAT='\.ralph/|\.omc/|\.codex/|\.ai/' for skill_dir in ~/.claude/skills/*/ ~/.agents/skills/*/; do skill_name=$(basename "$skill_dir") skill_md="$skill_dir/SKILL.md" [ -f "$skill_md" ] || continue
set -euo pipefail
HOOKS_DIR="$HOME/.claude/hooks"
SETTINGS="$HOME/.claude/settings.json"
SKILLS_DIRS=("$HOME/.claude/skills")
DRY_RUN=false
LIST_ONLY=false|-----------|-----------| | `name` | Keep as-is (suffix removal recommended) | | `description` | Add triggers keywords | | `tools` | Remove (skills use all tools by default) | | `model` | Keep (optional) | | Script references | Copy to `scripts/` folder, change to relative paths |
Follow the [writer.md](./writer.md) guide to create the skill structure: 1. Create folder: `mkdir -p ~/.claude/skills/<skill-name>/scripts` 2. Write SKILL.md (frontmatter + body) 3. Copy scripts and `chmod +x` ### 4. Move Original
| `model` | Keep (optional) | | Script references | Copy to `scripts/` folder, change to relative paths | ### 3. Create Skill Follow the [writer.md](./writer.md) guide to create the skill structure:
60/60 vendors flagged this skill as clean.
No suspicious patterns detected.