skill-security-analyzer

Name: skill-security-analyzer
Author: Svenja-dev

5installs5forks

How to install skill-security-analyzer?

svenja-dev/claude-code-skills/skill-security-analyzer

$npx -y skills add Svenja-dev/claude-code-skills --skill skill-security-analyzer

Installs into the current project.

Summary

Comprehensive security risk analysis for Claude skills. Use when asked to analyze security risks, review security stance, audit skills for vulnerabilities, check security before deployment, or evaluate safety of skill files. Triggers include "analyze security," "security risks,"

Files · 1

View on GitHub

SKILL.md

1	# Skill Security Analyzer
2
3	Analyze Claude skills for security risks, vulnerabilities, and safety concerns before deployment.
4
5	## When to Use This Skill
6
7	Use this skill whenever security analysis of a Claude skill is requested, including:
8	- "Analyze the security of this skill"
9	- "What are the security risks in my [skill-name]?"
10	- "Review this skill for vulnerabilities"
11	- "Is this skill safe to deploy?"
12	- "Check this skill for security issues"
13	- "Audit this skill before I use it"
14
15	## Analysis Process
16
17	Security analysis follows a systematic workflow:
18
19	1. Extract skill contents - If provided as a .skill file, extract and examine all components
20	2. Review skill metadata - Analyze name, description, and stated purpose
21	3. Examine SKILL.md - Review instructions and identify potential risks
22	4. Inspect bundled resources - Analyze scripts, references, and assets for security issues
23	5. Cross-reference patterns - Check against known security patterns (see references/security_patterns.md)
24	6. Generate findings - Compile severity-rated list of identified risks
25	7. Create output - Provide executive summary, findings list, and security checklist
26
27	## Output Format
28
29	Provide three components in this order:
30
31	### 1. Executive Summary (2-3 sentences)
32	Brief overall assessment with key takeaway. Examples:
33	- "This skill has CRITICAL security risks including undisclosed network access and potential data exfiltration. Do not deploy without major modifications."
34	- "This skill demonstrates good security practices with minor concerns around input validation. Generally safe for deployment with awareness of limitations."
35
36	### 2. Findings List
37	Severity-rated list of specific security issues found:
38
39	CRITICAL - Immediate security threat, do not deploy
40	- [Specific finding with evidence]
41	- [Specific finding with evidence]
42
43	HIGH - Significant risk, requires remediation
44	- [Specific finding with evidence]
45
46	MEDIUM - Moderate concern, should be addressed
47	- [Specific finding with evidence]
48
49	LOW - Minor issue or best practice deviation
50	- [Specific finding with evidence]
51
52	POSITIVE - Security best practices observed
53	- [Specific good practice found]
54
55	### 3. Security Checklist
56	Quick reference checklist of security categories:
57
58	```
59	[ ] Data Exfiltration Risks - [PASS/FAIL/CONCERN] - [brief note]
60	[ ] Network Access - [PASS/FAIL/CONCERN] - [brief note]
61	[ ] Prompt Injection Protection - [PASS/FAIL/CONCERN] - [brief note]
62	[ ] Permissions & Scope - [PASS/FAIL/CONCERN] - [brief note]
63	[ ] PII/Confidential Data - [PASS/FAIL/CONCERN] - [brief note]
64	[ ] Malicious Code Indicators - [PASS/FAIL/CONCERN] - [brief note]
65	[ ] Supply Chain Risks - [PASS/FAIL/CONCERN] - [brief note]
66	[ ] Credential Exposure - [PASS/FAIL/CONCERN] - [brief note]
67	[ ] Resource Abuse - [PASS/FAIL/CONCERN] - [brief note]
68	[ ] Transparency & Documentation - [PASS/FAIL/CONCERN] - [brief note]
69	```
70
71	## Analyzing Skill Components
72
73	### Skill Metadata Analysis
74
75	Check frontmatter and description for:
76	- Scope clarity: Does description match actual functionality?
77	- Tool disclosure: Are all used tools mentioned?
78	- External service disclosure: Are API calls or network access mentioned?
79	- Data handling statements: Is data processing clearly explained?
80
81	Red flags:
82	- Vague descriptions that don't explain what the skill does
83	- Description doesn't mention tools used in code
84	- Missing disclosure of network access or external services
85
86	### SKILL.md Analysis
87
88	Read the entire SKILL.md and check for:
89	- Instruction clarity: Are instructions clear and unambiguous?
90	- Input handling: How does skill handle user input?
91	- Tool usage justification: Is tool usage appropriate for stated purpose?
92	- Prompt construction: Are there prompt injection risks?
93	- Scope boundaries: Does skill stay within stated purpose?
94
95	Specific checks:
96	1. Search for dynamic prompt construction patterns
97	2. Check for file access instructions without validation
98	3. Look for network requests not in description
99	4. Identify any instruction override patterns
100	5. Review error handling and data exposure
101
102	### Scripts Analysis
103
104	For each script in `scripts/`:
105	1. Read the script using the view tool
106	2. Check imports against security patterns reference
107	3. Scan for dangerous operations: file deletion, system commands, network requests
108	4. Look for obfuscation: base64, exec, eval, encoded strings
109	5. Validate paths: check file access uses safe paths
110	6. Review subprocess usage: check for shell=True or user input in commands
111
112	**Priority patterns to dete

People who liked this also viewed

6 picks

Type

skill-security-analyzer

5installs5forks

View on GitHub

How to install skill-security-analyzer?

svenja-dev/claude-code-skills/skill-security-analyzer

$npx -y skills add Svenja-dev/claude-code-skills --skill skill-security-analyzer

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Skill Security Analyzer
2
3	Analyze Claude skills for security risks, vulnerabilities, and safety concerns before deployment.
4
5	## When to Use This Skill
6
7	Use this skill whenever security analysis of a Claude skill is requested, including:
8	- "Analyze the security of this skill"
9	- "What are the security risks in my [skill-name]?"
10	- "Review this skill for vulnerabilities"
11	- "Is this skill safe to deploy?"
12	- "Check this skill for security issues"
13	- "Audit this skill before I use it"
14
15	## Analysis Process
16
17	Security analysis follows a systematic workflow:
18
19	1. Extract skill contents - If provided as a .skill file, extract and examine all components
20	2. Review skill metadata - Analyze name, description, and stated purpose
21	3. Examine SKILL.md - Review instructions and identify potential risks
22	4. Inspect bundled resources - Analyze scripts, references, and assets for security issues
23	5. Cross-reference patterns - Check against known security patterns (see references/security_patterns.md)
24	6. Generate findings - Compile severity-rated list of identified risks
25	7. Create output - Provide executive summary, findings list, and security checklist
26
27	## Output Format
28
29	Provide three components in this order:
30
31	### 1. Executive Summary (2-3 sentences)
32	Brief overall assessment with key takeaway. Examples:
33	- "This skill has CRITICAL security risks including undisclosed network access and potential data exfiltration. Do not deploy without major modifications."
34	- "This skill demonstrates good security practices with minor concerns around input validation. Generally safe for deployment with awareness of limitations."
35
36	### 2. Findings List
37	Severity-rated list of specific security issues found:
38
39	CRITICAL - Immediate security threat, do not deploy
40	- [Specific finding with evidence]
41	- [Specific finding with evidence]
42
43	HIGH - Significant risk, requires remediation
44	- [Specific finding with evidence]
45
46	MEDIUM - Moderate concern, should be addressed
47	- [Specific finding with evidence]
48
49	LOW - Minor issue or best practice deviation
50	- [Specific finding with evidence]
51
52	POSITIVE - Security best practices observed
53	- [Specific good practice found]
54
55	### 3. Security Checklist
56	Quick reference checklist of security categories:
57
58	```
59	[ ] Data Exfiltration Risks - [PASS/FAIL/CONCERN] - [brief note]
60	[ ] Network Access - [PASS/FAIL/CONCERN] - [brief note]
61	[ ] Prompt Injection Protection - [PASS/FAIL/CONCERN] - [brief note]
62	[ ] Permissions & Scope - [PASS/FAIL/CONCERN] - [brief note]
63	[ ] PII/Confidential Data - [PASS/FAIL/CONCERN] - [brief note]
64	[ ] Malicious Code Indicators - [PASS/FAIL/CONCERN] - [brief note]
65	[ ] Supply Chain Risks - [PASS/FAIL/CONCERN] - [brief note]
66	[ ] Credential Exposure - [PASS/FAIL/CONCERN] - [brief note]
67	[ ] Resource Abuse - [PASS/FAIL/CONCERN] - [brief note]
68	[ ] Transparency & Documentation - [PASS/FAIL/CONCERN] - [brief note]
69	```
70
71	## Analyzing Skill Components
72
73	### Skill Metadata Analysis
74
75	Check frontmatter and description for:
76	- Scope clarity: Does description match actual functionality?
77	- Tool disclosure: Are all used tools mentioned?
78	- External service disclosure: Are API calls or network access mentioned?
79	- Data handling statements: Is data processing clearly explained?
80
81	Red flags:
82	- Vague descriptions that don't explain what the skill does
83	- Description doesn't mention tools used in code
84	- Missing disclosure of network access or external services
85
86	### SKILL.md Analysis
87
88	Read the entire SKILL.md and check for:
89	- Instruction clarity: Are instructions clear and unambiguous?
90	- Input handling: How does skill handle user input?
91	- Tool usage justification: Is tool usage appropriate for stated purpose?
92	- Prompt construction: Are there prompt injection risks?
93	- Scope boundaries: Does skill stay within stated purpose?
94
95	Specific checks:
96	1. Search for dynamic prompt construction patterns
97	2. Check for file access instructions without validation
98	3. Look for network requests not in description
99	4. Identify any instruction override patterns
100	5. Review error handling and data exposure
101
102	### Scripts Analysis
103
104	For each script in `scripts/`:
105	1. Read the script using the view tool
106	2. Check imports against security patterns reference
107	3. Scan for dangerous operations: file deletion, system commands, network requests
108	4. Look for obfuscation: base64, exec, eval, encoded strings
109	5. Validate paths: check file access uses safe paths
110	6. Review subprocess usage: check for shell=True or user input in commands
111
112	**Priority patterns to dete

People who liked this also viewed

6 picks

Type