Claude Skill Auditor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Claude Skill Auditor (Agent Skill) and scored it 65/100 (yellow). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 4 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 4 flagged
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<p align="center"> <a href="README_en.md">English</a> | <a href="README.md">中文</a> </p>
<p align="center"> <img src="https://img.shields.io/badge/Claude-Skill%20Auditor-blueviolet?style=for-the-badge" alt="Claude Skill Auditor"> <br> <strong>Claude Skill 安全审计工具</strong> <br> <em>在安装第三方 Skill 之前检测恶意模式</em> </p>
<p align="center"> <a href="https://pypi.org/project/claude-skill-auditor/"><img src="https://img.shields.io/pypi/v/claude-skill-auditor.svg?style=flat-square&color=blue" alt="PyPI version"></a> <a href="https://pypi.org/project/claude-skill-auditor/"><img src="https://img.shields.io/pypi/pyversions/claude-skill-auditor.svg?style=flat-square" alt="Python versions"></a> <a href="https://github.com/awch-D/claude-skill-auditor/actions"><img src="https://img.shields.io/github/actions/workflow/status/awch-D/claude-skill-auditor/ci.yml?style=flat-square&label=tests" alt="CI"></a> <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/license-MIT-green.svg?style=flat-square" alt="License"></a> </p>
<p align="center"> <a href="#安装">安装</a> • <a href="#快速开始">快速开始</a> • <a href="#功能特性">功能特性</a> • <a href="#ci-集成">CI 集成</a> • <a href="#自定义规则">自定义规则</a> • <a href="docs/ARCHITECTURE.md">架构文档</a> </p>
📐 [查看完整架构文档 →](docs/ARCHITECTURE.md)
%%{init: {'theme': 'dark', 'themeVariables': { 'primaryColor': '#000000', 'primaryTextColor': '#ffffff', 'primaryBorderColor': '#ffffff', 'lineColor': '#ffffff', 'secondaryColor': '#1a1a1a', 'background': '#000000', 'nodeBorder': '#ffffff', 'clusterBkg': '#1a1a1a', 'clusterBorder': '#ffffff'}}}%%
flowchart LR
subgraph INPUT["📥 输入"]
A["Skill 文件"]
end
subgraph PROCESS["⚙️ 处理"]
B["解析器"] --> C["规则引擎"] --> D["分析器"]
end
subgraph OUTPUT["📤 输出"]
E["报告"]
end
A --> B
D --> E第三方 Claude Skill 可能包含隐藏的恶意指令：
claude-skill-auditor 在安装 Skill 之前扫描文件，检测 7 大风险类别中的 21+ 种攻击模式。
pip install claude-skill-auditor<details> <summary><strong>其他安装方式</strong></summary>
pipx install claude-skill-auditorgit clone https://github.com/awch-D/claude-skill-auditor.git
cd claude-skill-auditor
pip install -e .</details>
验证安装：
skill-auditor --version# 自动扫描所有 Claude Skill 位置
skill-auditor scan-all
# 扫描个人全局技能 (~/.claude/skills/)
skill-auditor scan --global
# 扫描项目本地技能 (./.claude/skills/)
skill-auditor scan --project
# 显示当前系统的 Claude Skill 路径
skill-auditor pathsskill-auditor audit ./path/to/SKILL.md输出示例：
╭─────────────────────────────────────────────────────────────╮
│ Skill 安全审计报告 │
╰─────────────────────────────────────────────────────────────╯
文件: suspicious-skill.md
风险评分: 85/100
┏━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ 严重级别 ┃ 发现问题 ┃
┡━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
│ 严重 │ [PI-001] 检测到忽略之前指令的模式 │
│ 严重 │ [DE-001] 发现外部 webhook URL │
│ 高危 │ [CI-001] 危险的 rm -rf 命令 │
└──────────┴─────────────────────────────────────────────────┘
建议: 请勿安装此 Skill# 扫描文件夹中的所有 skill
skill-auditor scan ./skills/
# 递归扫描并生成报告
skill-auditor scan ./skills/ -r -o ./reports/# JSON（用于自动化）
skill-auditor audit ./SKILL.md -f json
# SARIF（用于 GitHub Code Scanning）
skill-auditor audit ./SKILL.md -f sarif -o results.sarif
# Markdown（人工阅读）
skill-auditor audit ./SKILL.md -f markdown| 类别 | 检测内容 | 严重级别 |
|---|---|---|
| Prompt 注入 | 忽略指令、角色操纵、隐藏命令 | 严重 |
| 数据泄露 | Webhook、外部 API、批量数据收集 | 严重 |
| 命令注入 | rm -rf、curl 管道、包管理器滥用 | 严重 |
| 凭证暴露 | 环境变量、API 密钥、硬编码密钥 | 严重 |
| 权限滥用 | 无限制工具、危险工具组合 | 高危 |
| 路径遍历 | ~/.ssh、/etc/passwd、敏感目录 | 高危 |
| 社会工程 | 紧迫感操纵、权威冒充 | 中危 |
21+ 条内置规则，基于真实攻击模式。
name: Skill 安全审计
on: [push, pull_request]
jobs:
audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: 设置 Python
uses: actions/setup-python@v5
with:
python-version: '3.11'
- name: 安装审计工具
run: pip install claude-skill-auditor
- name: 审计 skills
run: skill-auditor scan ./skills/ -r --fail-on high
- name: 上传 SARIF
if: always()
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: results.sarif# 高危及以上时阻断（默认）
skill-auditor audit ./SKILL.md --fail-on high
# 仅严重级别时阻断
skill-auditor audit ./SKILL.md --fail-on critical
# 仅报告，不阻断
skill-auditor audit ./SKILL.md --fail-on none使用 YAML 创建自定义规则：
# my-rules/internal.yaml
rule_set:
id: "internal-rules"
name: "内部安全规则"
version: "1.0.0"
rules:
- id: "INT-001"
name: "内部 API 引用"
severity: high
category: data_exfiltration
description: "Skill 引用了内部 API 端点"
patterns:
- "(?i)https?://internal\\."
- "(?i)https?://.*\\.internal\\."
recommendation: "发布前移除内部 API 引用"使用自定义规则：
skill-auditor audit ./SKILL.md --rules-dir ./my-rules/<details> <summary><strong>skill-auditor scan-all</strong></summary>
用法: skill-auditor scan-all [选项]
自动扫描所有 Claude Skill 位置。
发现并扫描以下位置的技能:
- 个人全局: ~/.claude/skills/
- 项目本地: ./.claude/skills/
选项:
-o, --output PATH 报告输出目录
-f, --format [json|markdown|sarif]
输出格式（默认: json）
--help 显示帮助信息</details>
<details> <summary><strong>skill-auditor scan</strong></summary>
用法: skill-auditor scan [选项] [目录]
扫描目录中的多个 Skill 文件。
选项:
-r, --recursive 递归扫描（默认: 是）
-o, --output PATH 报告输出目录
-f, --format [json|markdown|sarif]
输出格式（默认: json）
-g, --global 扫描个人全局技能 (~/.claude/skills/)
-p, --project 扫描项目本地技能 (./.claude/skills/)
--help 显示帮助信息</details>
<details> <summary><strong>skill-auditor audit</strong></summary>
用法: skill-auditor audit [选项] SKILL_PATH
审计单个 Skill 文件的安全风险。
选项:
-f, --format [json|markdown|sarif] 输出格式（默认: markdown）
-o, --output PATH 保存报告到文件
-s, --severity [low|medium|high|critical]
报告的最低严重级别
--fail-on [none|medium|high|critical]
达到级别时返回退出码 1
--rules-dir PATH 自定义规则目录
-v, --verbose 详细输出
--help 显示帮助信息</details>
<details> <summary><strong>skill-auditor paths</strong></summary>
用法: skill-auditor paths [选项]
显示当前系统的 Claude Skill 路径。
显示 Claude Skills 存储的标准位置。
选项:
--help 显示帮助信息</details>
<details> <summary><strong>skill-auditor init</strong></summary>
用法: skill-auditor init [选项]
创建配置文件。
选项:
-o, --output PATH 输出文件（默认: skill-audit-config.yaml）
--help 显示帮助信息</details>
| 代码 | 含义 |
|---|---|
0 | 审计通过（无达到阈值的问题） |
1 | 审计失败（发现达到 --fail-on 级别的问题） |
click, pyyaml, richpip uninstall claude-skill-auditor欢迎贡献！请参阅 CONTRIBUTING.md 了解指南。
MIT 许可证 - Claude Skill Auditor Team
<p align="center"> <sub>为 Claude 生态系统安全而构建</sub> </p>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.