AI 에이전트 기술에 대한 보안 감사 CLI.

AI Agent는 점점 "skills"를 사용합니다 - 에이전트의 기능을 확장하는 지침 및 실행 가능한 코드를 포함하는 모듈 식 패키지. 이 기술은 기계에 코드를 실행할 수 있으며 제대로 vetted 경우 중요한 보안 위험을 만듭니다.

Skill-audit는 신뢰하기 전에 기술 감사를 돕습니다.

특징

• ܧPrompt Injection Detection - 탈옥 패턴 및 조작 시도를위한 스캔 기술 설명
• AzurSecret Scanning - 하드 코딩된 API 키, 토큰 및 자격 증명을 찾습니다 ( trufflehog/gitleaks를 통해)
• S **Shell Script Analysis ** - 위험한 패턴의 bash 스크립트를 확인합니다 (shellcheck를 통해)
• Code Security - 보안 문제의 Python/JS 코드 분석 ( semgrep를 통해)
• **SARIF 산출 ** - GitHub Actions 통합을 위한 CI/CD 준비 출력 형식
• colo Extensible - 사용자 정의 스캐너 플러그인

설치

맥 OS

**쉘 프로파일에 추가 ** (선택 사항, 글로벌 액세스에 대 한):

리눅스

부터 PyPI

사용법

기본 감사

산출 체재

유효한 공구를 검사하십시오

엄격한 형태

확인하는 것

Prompt/Instruction 분석

skill-audit

🔒 Security auditing CLI for AI agent skills.

AI agents increasingly use “skills” - modular packages containing instructions and executable code that extend an agent’s capabilities. These skills can execute code on your machine, making them a significant security risk if not properly vetted.

skill-audit helps you audit skills before trusting them.

Features

• 🔍 Prompt Injection Detection - Scans skill descriptions for jailbreak patterns and manipulation attempts
• 🔑 Secret Scanning - Finds hardcoded API keys, tokens, and credentials (via trufflehog/gitleaks)
• 🐚 Shell Script Analysis - Checks bash scripts for dangerous patterns (via shellcheck)
• 🐍 Code Security - Analyzes Python/JS code for security issues (via semgrep)
• 📄 SARIF Output - CI/CD ready output format for GitHub Actions integration
• 🔌 Extensible - Plugin architecture for custom scanners

Installation

macOS

# 1. Clone the repo
git clone https://github.com/markpors/skill-audit
cd skill-audit

# 2. Create virtual environment and install
python3 -m venv .venv
source .venv/bin/activate
pip install -e .

# 3. Install security tools (recommended)
brew install shellcheck semgrep trufflehog

# Note: gitleaks is an alternative to trufflehog (only need one)
# brew install gitleaks

# 4. Verify installation
skill-audit check-tools

Add to your shell profile (optional, for global access):

# Add to ~/.zshrc or ~/.bashrc
alias skill-audit="source ~/dev/skill-audit/.venv/bin/activate && skill-audit"

Linux

# 1. Clone and install
git clone https://github.com/markpors/skill-audit
cd skill-audit
python3 -m venv .venv
source .venv/bin/activate
pip install -e .

# 2. Install security tools
pip install semgrep
sudo apt install shellcheck  # Debian/Ubuntu
# For trufflehog: https://github.com/trufflesecurity/trufflehog#installation

From PyPI

pip install skill-audit

Usage

Basic Audit

# Audit a skill directory
skill-audit audit ./my-skill/

# Audit a specific file
skill-audit audit ./my-skill/SKILL.md

Output Formats

# Pretty terminal output (default)
skill-audit audit ./my-skill/

# JSON output
skill-audit audit ./my-skill/ --format json

# SARIF output (for CI/CD)
skill-audit audit ./my-skill/ --format sarif -o results.sarif

Check Available Tools

skill-audit check-tools

Strict Mode

# Fail on warnings (not just errors)
skill-audit audit ./my-skill/ --strict

What It Checks

Prompt/Instruction Analysis

• Jailbreak patterns (“ignore previous instructions”, “DAN mode”, etc.)
• Role manipulation attempts (“you are root”, “pretend to be admin”)
• Data exfiltration instructions
• Safety bypass attempts

Code Analysis

• Hardcoded secrets and credentials
• Dangerous shell patterns (rm -rf, eval, etc.)
• Arbitrary code execution risks
• Subprocess injection vulnerabilities

Exit Codes