Skill Security Scanner

This skill appears to do what it says: it downloads skill bundles (when asked), extracts them to temporary directories, and performs pattern-based checks. That behavior is necessary for a pre-install scanner and is not itself malicious. Before installing or running it: 1) review the scanner code (scripts/scanner.py) yourself or run it in a sandbox to confirm behavior; 2) remember pattern-based scanners have false positives and false negatives — don't rely on it as the sole defense; 3) when integrating into CI or pre-commit hooks, check the hook logic so you understand when commits can be blocked or bypassed (git commit --no-verify); and 4) keep the allowlist/patterns under version control and review updates from third parties before trusting them. If you want higher assurance, run the scanner in an offline environment or container and inspect downloaded skill contents before any install.