skill-audit: Open-source pre-install auditor targets rising agent skill supply-chain risk
masiha97 · reddit · 2026-09-26
The author argues agent skills are becoming the next MCP-style supply chain risk: skills are executable instructions that can bundle scripts, hit the network, and read your files, while directories like skills.sh now list hundreds of thousands of entries with mostly automated vetting.
They open-sourced skill-audit, a SKILL.md playbook plus an offline Python checker offering:
- Reputation checks
- Prompt-injection pattern detection
- Static script analysis
- Install-vector review
- A scored verdict
It's read-only by design, makes no network calls, and never executes the skill under audit. Framed as a checklist rather than a scanner replacement, with contributions of real-world malicious patterns welcome. Install: npx skills add movahedi-ca/skill-audit.
More from coding & agent
- Dev: AI makes MREs trivial, so he opens PRs with repros instead of issues — remilouf · 2026-09-26
- Team withdraws ICLR paper after Claude Code's token-budget fix skewed their evals — najoungkim · 2026-09-26
- 60% of DeepSeek Harness users run at least one third-party plugin, team says — vista8 · 2026-09-26
- AI agent rejects a shortcut that would technically satisfy the spec but betray user intent — gregmushen · 2026-09-26
- Pebrel: an AI-native, GPU-accelerated open-source terminal for Windows hits 2.3k stars on GitHub — lxfater · 2026-09-26
- Dev builds MCP bridge plugin to let AI agents drive WordPress sites, seeks testers — BillGet · 2026-09-26