Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIDeepSeekDeepSeekMuseMuse+22 more

    Skill Hardening Certifier

    6

    A rule-based security scanner and auto-hardener for AI agent skills to detect injections and unsafe code.

    $7

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    skill-hardening-certifier

    skill-hardening-certifier

    Example session with this skill installed

    Audit the 'file-transfer-skill' folder for security risks and generate a hardened version.

    • Read your context and instructions
    • Compiled the -hardening-certifier

    Scan complete. Found 1 HIGH (shell execution) and 2 MEDIUM (unvalidated URL fetch) risks. Hardened copy created in /dist/hardened-file-transfer. Summary:

    • Fixed: Raw curl pipe to bash.
    • Flagged: Potential SSRF in fetch_meta.py (added TODO).
    • Certificate: generated high-risk-residual.md.
    generated high-risk-residual.md

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Security Auditing for AI Agent Skills

    The Skill Hardening Certifier is a specialized security tool designed for developers and platform operators who need to audit AI agent skills. As the ecosystem for agentic tools grows, so does the risk of prompt injection, data exfiltration, and unsafe code execution. Providing a simple prompt to an LLM isn't enough to catch subtle security flaws; you need a structured, rule-based scanning engine.

    What it does

    This skill performs a multi-stage security analysis on target skill directories. It parses SKILL.md files and associated helper scripts (Python, JavaScript, Shell) to identify critical vulnerabilities. The process involves:

    • Automated Scanning: Detects prompt injection patterns, secret exfiltration, raw network calls, and unguarded shell execution.
    • Severity Scoring: Categorizes findings from LOW to CRITICAL with actionable remediation hints.
    • Automated Hardening: Generates a "hardened" version of the skill, applying mechanical fixes and inserting TODO flags where human judgment is required.
    • Certification: Produces a formal security report and certificate summarizing the residual risk.

    Why use this skill

    Unlike general-purpose security scanners, this tool is specifically tuned for the unique threat model of LLM skills, such as instructions that attempt to override host agent safety protocols or bypass user approval. It provides a repeatable, verifiable pipeline to ensure the skills you deploy—or buy—meet a baseline security standard.

    Built by Nex AI. More skills and info at nex-ai.be and slopsome.com.

    Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for Security.

    • Rule-based detection may miss novel obfuscated injections.
    • Cannot analyze compiled binaries or encrypted scripts.
    • Requires manual review for logical business-risk flaws.

    Open docs

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before buying a skill.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 1 month ago

    Accounts
    Evil

    Permissions

    Terminal / Shell
    Network Access
    Environment Variables

    Allowed Hosts

    collector.evil.example
    evil.example
    Listed5 months ago
    Updated1 month ago

    What's inside

    Frequently Asked Questions

    The certifier uses a rule-based engine to scan for prompt injection patterns, hidden exfiltration hooks, raw network calls, and unsafe shell execution that standard linting tools often miss.

    Yes, the tool is language-agnostic regarding the host agent; it scans the underlying SKILL.md instructions as well as helper scripts written in Python, JavaScript, and Shell.

    The skill generates a 'hardened' version of your files with mechanical security fixes applied and TODO flags inserted where manual oversight is required for architectural changes.

    Each purchase includes the core analysis engine, a library of current threat definitions, and a reporting template that generates formal security certificates for your logs.

    This tool is a local scanner that runs within your development environment; it does not require your proprietary code to be uploaded to an external cloud or non-local LLM.

    New in Security