Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent local evaluator for agent skills, with disclosed file-reading and optional eval scaffold writing that fit its purpose.
Install this if you want local QA guidance and a static evaluator for agent skills. Review the target skill before running any runtime tests, use isolation for unfamiliar or side-effectful skills, and avoid --scaffold unless replacing or creating eval.yaml is acceptable.
Referenced artifact was not completely inspected
Hub, skills.sh, and similar directories. Includes the bundled static evaluator `scripts/eval_skill.py` plus guidance for optional deterministic or LLM-assisted
Referenced artifact was not completely inspected
Hub, skills.sh, and similar directories. Includes the bundled static evaluator `scripts/eval_skill.py` plus guidance for optional deterministic or LLM-assisted
Referenced artifact was not completely inspected
Hub, skills.sh, and similar directories. Includes the bundled static evaluator `scripts/eval_skill.py` plus guidance for optional deterministic or LLM-assisted
Referenced artifact was not completely inspected
Always start by reading the target `SKILL.md`, then run:
Referenced artifact was not completely inspected
Always start by reading the target `SKILL.md`, then run:
Referenced artifact was not completely inspected
Always start by reading the target `SKILL.md`, then run:
Referenced artifact was not completely inspected
Always start by reading the target `SKILL.md`, then run:
Referenced artifact was not completely inspected
Always start by reading the target `SKILL.md`, then run:
Referenced artifact was not completely inspected
Always start by reading the target `SKILL.md`, then run:
Referenced artifact was not completely inspected
Always start by reading the target `SKILL.md`, then run:
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- id: negative-trigger-seo-only
prompt: |
Rewrite this skill description so it ranks better on skills.sh, but do not run any quality evaluation.
expect:
should_trigger: false
Without declared permissions the skill's intent is opaque and cannot be validated.
The description says to use this skill when you need to "test a skill, write evals, benchmark quality, catch regressions, audit trigger accuracy, compare versions, or decide whether a skill is ready to publish." Several phrases like "write evals," "benchmark quality," and "compare versions" are broad and could overlap with ordinary software-review requests unless the target being evaluated is explicitly a skill.
The trigger case uses broad language about being 'ready to publish,' 'release blockers,' and 'regression risks,' which can match ordinary review or project-readiness discussions rather than a clear request to invoke this specific skill. That ambiguity increases the chance of unintended triggering, causing the agent to activate the skill in contexts where the user did not actually request a formal skill evaluation workflow.
This markdown file includes example positive trigger categories such as 'Task description: Set up X with Y for Z' and a broad natural-language request about scaffolding a demo. These examples are generic enough to match many ordinary user requests, and the document does not pair them with concrete scope constraints for when a skill should or should not activate.
In scaffold mode, the code unconditionally writes to skill_dir / "eval.yaml". Although it logs after the fact, there is no prior confirmation or overwrite warning in code comments/docstrings at the write site, so a user may not realize an existing eval.yaml will be replaced.
The prompt "Run the skill-test grader against this skill folder and show me the report" is reasonably specific, but the surrounding examples also normalize generic evaluation language across the document without consistently requiring explicit mention of agent skills. In a markdown skill description, that can make the trigger boundary less crisp for routing systems.
No suspicious patterns detected.