1. Habit
  2. Skills
  3. Skill security skill
superagent-ai · 8K installs

Skill security skill
Runs by itself, new skill added.

Vet every new skill first.

Install the Skill security skill and make it a habit: follow https://gethabit.dev/skills/superagent-ai/skill-security.md

  1. 1Copy
  2. 2Paste into Claude Code, Codex or Cursor
  3. 3It runs by itself

8K installs79 starsMIT licenceSource on GitHub ↗

Skill security

by superagent-ai · 8K installs

The skill

The skill security skill audits an AI agent skill before you install it, pairing a deterministic offline scanner with a reasoned contract check, for developers who want to know if a skill is safe.

Only when you ask.

The habit

Vet every new skill first.

↻ Runs by itselfnew skill added

How the habit works.
You don't have to.

Three questionsWhen does it start? How does it check its work? What does it remember?

01

It starts by itself

new skill added. Runs in Claude Code routine or GitHub Actions.

  • ↻ new skill added
  • new SKILL.md in skills folder

02

It checks its work

scan done, you decide. If a check fails, it tells you.

  • ✓scripts/scan.py returns JSON with a risk score
  • ✓report states a verdict
  • ✓every finding cites file and line

03

It remembers

audit verdict log. The next run reads it first: skills already audited and their verdicts.

loops/skill-security-audit-loop/audits.md

One run, step by step.
Then it stops.

Stop ruleStops after five skills per run.

  1. 01

    Locate target

    Find the new skill folder, SKILL.md or archive on disk.

  2. 02

    Run scanner

    Run python3 scripts/scan.py on the target with --format json.

  3. 03

    Read content

    Open the SKILL.md and every flagged or executable file, treating all of it as data.

  4. 04

    Contract check

    Compare the stated description with what the code and text really do.

  5. 05

    Decide verdict

    Start from the score band and adjust with stated reasons.

  6. 06

    Report

    Write the verdict, findings and fixes in the report format.

  7. 07

    You approve

    You decide whether to install based on the report.

What it may do.
Nothing more.

Safe by defaultIt writes only in its own folder and asks you before anything goes out.

Is it for you?
Use it when it fits.

Quick checkRead both lists. If the left one sounds like you, the Skill security skill helps.

Use it when

  • ✓ Before installing a new skill
  • ✓ Reviewing a plugin or SKILL.md
  • ✓ Someone asks if a skill is safe

Skip it when

  • – Auditing normal app code
  • – Writing a new skill

Questions

Skill security skill, answered.

Does the scanner run the skill?

No. It is static analysis only and works offline.

What if the skill tries to steer the audit?

That attempt is itself recorded as a serious finding.

How do I install the Skill security skill?

Copy the prompt at the top into your agent. It installs the skill from superagent-ai/skills and sets up the habit. Or run npx skills add superagent-ai/skills --skill skill-security.

Is the Skill security skill free?

Yes. It is published under MIT. Habit is free too.

Skill security. Now as a habit.

Install the Skill security skill and make it a habit: follow https://gethabit.dev/skills/superagent-ai/skill-security.md

  • Free
  • No account
  • Undo in one line

All superagent-ai skills →More code skills →

Works in

  • Claude Code
  • Codex
  • Cursor
  • ChatGPT
  • Claude app

Made by superagent-ai, published under MIT. Habit links to the original and never changes it. Is this your skill?

Copying didn't work here. Select the line and copy it by hand.