Skillrx — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Skillrx (Plugin) and scored it 15/100 (red). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 2 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
This plugin references the AWS credentials file or the access-key fields stored inside it (re: /AWS_SECRET_ACCESS_KEY\s*=\s*['"]?([A-Za-z0-…). Those are long-lived keys with broad cloud access, so any code that reads them can hand your whole AWS account to whatever it contacts next.
creds = open(os.path.expanduser("~/.aws/credentials")).read()
requests.post(url, data={"creds": creds})# let the SDK resolve credentials; never read or transmit the file yourself
import boto3
s3 = boto3.client("s3")Every scanned point with the score it earned and what moved between them.
Score fell 85 points between these scans.
The primary manifest — the file an agent reads to learn what this artifact does.
<p align="center"> <img src="./img/skillrx-img-0.svg" alt="skillrx" width="200" /> <br /><br /> <a href="https://www.npmjs.com/package/skillrx"><img src="https://img.shields.io/npm/v/skillrx?style=flat-square&logo=npm&label=npm" alt="npm" /></a> </p>
Security scanner for AI agent skills and plugins. Reviews the code before you install it.
npx skillrx owner/repoThat's it. skillrx clones the repo, analyzes it, and gives you a verdict: TRUSTED, CAUTION, RISKY, or MALICIOUS.
If it ships as a skill or plugin, skillrx reads it.
Full repository — point skillrx at a repo (or local folder). It scans the whole tree you give it (respecting filters and limits).
Single skill in a monorepo — for big skills collections (for example anthropics/skills), use --skill <name> so only skills/<name> is fetched with a sparse checkout instead of cloning everything.
npx skillrx anthropics/skills --skill frontend-design<table> <tr> <td align="center" width="50%"><strong>Full repository</strong><br /><br /><img src="./img/skillrx-img-1.svg" alt="Full repository scan" width="100%" /></td> <td align="center" width="50%"><strong>Single skill (<code>--skill</code>)</strong><br /><br /><img src="./img/skillrx-img-2.svg" alt="Single skill scan" width="100%" /></td> </tr> </table>
| Area | What it detects | |
|---|---|---|
| Prompt injection | Attempts to hijack the agent's role or coerce its tools | |
| Shadow features | What the README promises vs what the code actually does | |
| Exfiltration | Odd endpoints, URL shorteners, hardcoded IPs, DNS exfil | |
| Secrets | Exposed API keys, tokens, JWTs, private blocks | |
| Dangerous permissions | Destructive shell, persistence, privilege escalation | |
| Post-install scripts | npm lifecycle hooks, `curl | sh, risky setup.py`, git hooks |
Starts at 100. Each finding subtracts points based on severity:
If a critical rule fires (hardcoded secrets, reverse shells, install-time curl | sh, severe prompt injection), the result jumps straight to MALICIOUS with score 0.
| Range | Verdict |
|---|---|
| 80–100 | TRUSTED |
| 50–79 | CAUTION |
| 0–49 | RISKY |
| Critical rule | MALICIOUS |
npx skillrx owner/repo --full # show every finding
npx skillrx owner/repo --json # JSON outputskillrx does not run npm install, node, or python against the repo. It only reads files and applies patterns. Pure static analysis, 100% offline (except for the initial clone).
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.