ww-skill-auditor

The problem: A skill you install is a markdown file, sometimes a script too, that gets read straight into your agent’s context and sometimes executed. It can ask your agent to read your .env file, pipe a remote script into bash, install a scheduled job, or quietly try to override its own instructions, and none of that is obvious from skimming the description on GitHub.

ww-skill-auditor reads the actual SKILL.md before it touches your system. Deterministic regex scans catch the known attack shapes: prompt-injection overrides, credential exfiltration, curl | bash, reverse shells, hook or LaunchAgent installation. A cheap-model second pass (Cerebras, free tier) catches paraphrased versions the regex misses. A short known-good author list lowers the bar for publishers you already trust; everyone else defaults to CAUTION even at zero pattern hits.

Commands


python3 audit.py "<author>/<repo>/<skill>"          # npx skills add spec
python3 audit.py "https://github.com/.../SKILL.md"  # raw, or blob/tree URL
python3 audit.py --file /path/to/SKILL.md           # local file

Exit code	Verdict	Meaning
0	SAFE	No signals, known-good author. Proceed.
1	CAUTION	Low-risk findings, or an unknown author. Review before approving.
2	UNSAFE	High-risk pattern hit. Do not install.
3	UNKNOWN	Could not fetch, or inconclusive. Do not install until the source is locatable.

Key principles

Severity scales with blast radius: medium for skills, high for agents and plugins, critical for hooks, since a hook runs automatically with nobody in the loop
Pattern hits always override author reputation; a known-good author can still ship a regressed skill
The semantic check fails open, no key means it silently skips, so a missing Cerebras key never blocks the deterministic half
Never install on inferred consent; the verdict has to be visible to whoever approves, every time

Part of Operator Skills, a collection of skills for running a real Claude Code setup.