Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent AgentSkill authoring helper; it can create, edit, validate, and package skill files, but I found no hidden execution, exfiltration, or deceptive behavior.
Install this only if you want an agent to help create or modify AgentSkill packages. Review generated skill changes before using or publishing them, and be careful when adding real secrets, persistent memory, or hooks to any skill this tool helps author.
The reported behavior expansion into packaging and test-like/archive-handling workflows exceeds the declared review/editing purpose and can expose filesystem/archive behaviors not obvious from the trigger text. Even if some of the static-analysis wording references related files or inferred capabilities, the core issue remains that the skill's activation criteria are broader than its stated side effects.
The reported behavior expansion into packaging and test-like/archive-handling workflows exceeds the declared review/editing purpose and can expose filesystem/archive behaviors not obvious from the trigger text. Even if some of the static-analysis wording references related files or inferred capabilities, the core issue remains that the skill's activation criteria are broader than its stated side effects.
The skill explicitly guides writing and modifying SKILL.md and restructuring skill contents, which is a self-modification capability when used within a live agent-skill environment. Self-modifying instructions are high risk because they can alter future agent behavior, broaden triggers, or smuggle in unsafe tool guidance that persists beyond the current session.
- Specific triggers/contexts for when to use it
- Concrete examples of user requests that should activate it
#### Write SKILL.md Body
Keep under 500 lines. Use references/ for detailed content.
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
# Print next steps
print(f"\n[OK] Skill '{skill_name}' initialized successfully at {skill_dir}")
print("\nNext steps:")
print("1. Edit SKILL.md to complete the TODO items and update the description")
if resources:
if include_examples:
print("2. Customize or delete the example files in scripts/, references/, and assets/")
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def test_skips_symlink_to_external_file(self):
skill_dir = self.create_skill("symlink-file-skill")
outside = self.temp_dir / "outside-secret.txt"
outside.write_text("super-secret\n")
link = skill_dir / "loot.txt"
out_dir = self.temp_dir / "out"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def test_skips_symlink_to_external_file(self):
skill_dir = self.create_skill("symlink-file-skill")
outside = self.temp_dir / "outside-secret.txt"
outside.write_text("super-secret\n")
link = skill_dir / "loot.txt"
out_dir = self.temp_dir / "out"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def test_skips_symlink_to_external_file(self):
skill_dir = self.create_skill("symlink-file-skill")
outside = self.temp_dir / "outside-secret.txt"
outside.write_text("super-secret\n")
link = skill_dir / "loot.txt"
out_dir = self.temp_dir / "out"
The skill instructs use of scripts, packaging, filesystem operations, and hook examples, implying meaningful file and execution capabilities, but it declares no explicit tool scope or allowed-tools boundary. Without a declared scope, an agent may invoke broader tools than necessary when this skill triggers, increasing the blast radius of misuse or prompt-triggered overreach.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
---
version: "1.2.0"
name: skill-creator
description: Create, edit, improve, or audit AgentSkills. Use when creating a new skill from scratch or when asked to improve, review, audit, tidy up, or clean up an existing skill or SKILL.md file. Also use when editing or restructuring a skill directory (moving files to references/ or scripts/, removing stale content, validating against the AgentSkills spec). Triggers on phrases like "create a skill", "author a skill", "tidy up a skill", "improve this skill", "review the skill", "clean up the skill", "audit the skill".
---
# Skill Creator
The trigger phrases are broad and generic, such as 'improve this skill' or 'review the skill,' making accidental or overly frequent activation likely. Over-broad activation is dangerous here because the skill includes guidance for editing files, packaging outputs, and restructuring directories, which can steer an agent into side-effectful operations without sufficiently specific user intent.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
### Option 1: Check into Repository
For small teams, check skills into the repo (e.g., `./skills/` or `./.claude/skills`).
### Option 2: Plugin Marketplace
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
# Create SKILL.md with template
cat > skills/my-new-skill/SKILL.md << 'EOF'
---
name: my-new-skill
description: [description]
The trigger example "help me plan" is broad and can appear in ordinary conversation, which increases the chance that this skill activates when the user did not intend to invoke a structured multi-phase planning workflow. In a skill-creation context, overly broad activation can cause incorrect routing, unnecessary file access, or unintended modification/audit behavior across unrelated requests.
The manifest frames this skill as guidance for creating, improving, and auditing AgentSkills. The 'Memory & Storing Data' section introduces persistent data storage in locations like ~/.my-skill/data.json or ${CLAUDE_PLUGIN_DATA}, which is a broader operational capability not necessary for the core purpose of authoring or restructuring skill files.
The manifest describes a skill for creating, editing, improving, and auditing AgentSkills. The 'On Demand Hooks' section goes further by specifying runtime control behaviors such as blocking commands and restricting edits, which are capabilities of deployed skills rather than necessary functionality for authoring them.
A skill whose declared role is to create or audit AgentSkills does not inherently need to handle secrets-oriented configuration patterns. Recommending config files containing api_key and notification destinations expands into operational integration guidance that is not clearly covered by the manifest's narrower authoring-focused purpose.