# How to Perform Security Auditing on Claude Skills Before Installation

> Secure your Claude skills. Audit for command injection, credential harvesting, and supply-chain risks before installation with the zero-dependency Skill Security Auditor. Protect your projects.

- Repository: [Alireza Rezvani/claude-skills](https://github.com/alirezarezvani/claude-skills)
- Tags: security-guide
- Published: 2026-03-09

---

**Run the zero-dependency Skill Security Auditor on any Claude skill directory to detect command injection, credential harvesting, and supply-chain risks before executing installation commands.**

The **alirezarezvani/claude-skills** repository provides a modular marketplace of production-ready skill packages that extend Claude AI capabilities across engineering, product, and executive domains. Because these skills execute Python scripts and CLI commands on your local machine, **security auditing Claude skills before installation** is a mandatory step to prevent credential theft, malware injection, and data exfiltration. The repository includes a purpose-built auditor that scans for critical vulnerabilities without requiring external dependencies.

## The Skill Security Auditor Architecture

The repository includes a dedicated **Skill Security Auditor** located at [`engineering/skill-security-auditor/scripts/skill_security_auditor.py`](https://github.com/alirezarezvani/claude-skills/blob/main/engineering/skill-security-auditor/scripts/skill_security_auditor.py). This pure-Python tool uses only the standard library, ensuring it runs on any system with Python 3 regardless of the target skill's dependencies.

### Detection Patterns and Severity Levels

The auditor scans for six critical vulnerability categories:

- **Command Injection & Code Execution** – Detects `os.system`, `subprocess(..., shell=True)`, `eval`, and `exec` calls marked as **CRITICAL** severity.
- **Credential Harvesting** – Flags attempts to access `~/.ssh` private keys or read sensitive environment variables like `os.environ["API_KEY"]` as **CRITICAL**.
- **Obfuscation Techniques** – Identifies `base64.b64decode`, hex string decoding, and other payload hiding methods as **CRITICAL**.
- **Network Exfiltration** – Catches unauthorized `requests.post`, `urllib` calls, and `socket.connect` attempts as **CRITICAL**.
- **File-System Abuse** – Warns on writes to `/etc`, symlinks pointing outside the skill directory, and unauthorized system modifications as **HIGH** or **CRITICAL**.
- **Dependency Risks** – Scans [`requirements.txt`](https://github.com/alirezarezvani/claude-skills/blob/main/requirements.txt) for typosquatting (e.g., `reqeusts` instead of `requests`) and unpinned versions as **HIGH** or **INFO**.

### Verdict System

After analysis, the auditor assigns a **PASS**, **WARN**, or **FAIL** verdict. Only **PASS**-rated skills should be installed into your Claude environment. The tool outputs a formatted report showing exact file paths, line numbers, and remediation steps for any flagged issues.

## Pre-Installation Security Audit Workflow

Follow this sequence before adding any skill to Claude Code:

1. **Download the skill source** without executing installation scripts.
2. **Run the Skill Security Auditor** against the skill directory.
3. **Review the report** for CRITICAL or HIGH severity findings.
4. **Remediate or reject** the skill if the verdict is FAIL.
5. **Install only after** achieving a PASS verdict.

### Running the Auditor via CLI

Execute the auditor directly from the repository against your target skill:

```bash
python3 engineering/skill-security-auditor/scripts/skill_security_auditor.py \
    ~/.claude/skills/suspicious-skill-package

```

Typical successful output appears as:

```

╔═════════════════════════════════════════════════════════════════════╗
║  SKILL SECURITY AUDIT REPORT                                      ║
║  Skill: suspicious-skill-package                                  ║
║  Verdict: ✅ PASS                                                 ║
╠═════════════════════════════════════════════════════════════════════╣
║  🔴 CRITICAL: 0  🟡 HIGH: 0  ⚪ INFO: 2                               ║
║  Files: 12  Scripts: 5  Markdown: 2                                 ║
╚═════════════════════════════════════════════════════════════════════╝

```

### Programmatic Integration

Embed the auditor into your own validation pipelines by importing the core functions:

```python
from pathlib import Path
from engineering.skill_security_auditor.scripts.skill_security_auditor import scan_skill, print_report

skill_path = Path.home() / ".claude" / "skills" / "unverified-skill"
report = scan_skill(skill_path)
print_report(report)  # Uses the CLI formatter for consistent output

```

### Detecting Typosquatting Attacks

If a skill's [`requirements.txt`](https://github.com/alirezarezvani/claude-skills/blob/main/requirements.txt) contains a malicious typo like `reqeusts==2.31.0` instead of `requests`, the auditor flags it immediately:

```

🟡 HIGH [DEPS-TYPOSQUAT] requirements.txt:1
   Pattern: reqeusts==2.31.0
   Risk: Possible typosquatting — did you mean 'requests'?
   Fix: Verify package name. Likely should be 'requests'

```

Correct the dependency name and re-run the audit until the report shows zero HIGH or CRITICAL findings.

## Repository Security Standards and CI Validation

The **alirezarezvani/claude-skills** repository enforces organization-wide security through mandatory standards and automated pipeline checks documented in [`standards/security/security-standards.md`](https://github.com/alirezarezvani/claude-skills/blob/main/standards/security/security-standards.md).

### Security Standards Compliance

All skills must adhere to these non-negotiable rules:

- **No hard-coded secrets** – Credentials must use environment variable references only.
- **Pinned dependencies** – All [`requirements.txt`](https://github.com/alirezarezvani/claude-skills/blob/main/requirements.txt) entries must specify exact versions with hash verification.
- **Safe subprocess usage** – Shell execution is prohibited; all system calls must use argument lists.

### Continuous Integration Scans

Every pull request triggers automated security validation via GitHub Actions:

- **VirusTotal Scan** – The entire repository uploads to VirusTotal for malware detection ([`.github/workflows/virustotal-scan.yml`](https://github.com/alirezarezvani/claude-skills/blob/main/.github/workflows/virustotal-scan.yml)).
- **Bandit Linting** – Static analysis runs via Bandit to catch Python security anti-patterns ([`.github/workflows/ci-quality-gate.yml`](https://github.com/alirezarezvani/claude-skills/blob/main/.github/workflows/ci-quality-gate.yml)).

Only skills that pass both CI gates and manual auditor review are eligible for inclusion in the marketplace manifest at [`.claude-plugin/marketplace.json`](https://github.com/alirezarezvani/claude-skills/blob/main/.claude-plugin/marketplace.json).

## Manual Inspection Red Flags

While the automated auditor catches most threats, manually review these components before installation:

- **[`SKILL.md`](https://github.com/alirezarezvani/claude-skills/blob/main/SKILL.md) frontmatter** – Verify the author and version match the marketplace entry.
- **`scripts/` directory** – Ensure all Python files use standard library imports only unless explicitly required.
- **`assets/` templates** – Check Dockerfiles and CI configs for malicious base images or credential exfiltration steps.

## Summary

- **Always audit first** – Run [`skill_security_auditor.py`](https://github.com/alirezarezvani/claude-skills/blob/main/skill_security_auditor.py) on any skill before installation to catch command injection, credential harvesting, and network exfiltration attempts.
- **Zero-dependency scanning** – The auditor requires only Python 3 and works offline, making it safe to run on air-gapped systems.
- **Enforce repository standards** – Verify skills comply with [`standards/security/security-standards.md`](https://github.com/alirezarezvani/claude-skills/blob/main/standards/security/security-standards.md) and have passed CI security gates.
- **Reject non-PASS verdicts** – Never install skills rated **FAIL** or **WARN** without first remediating all CRITICAL and HIGH severity findings.

## Frequently Asked Questions

### What specific threats does the Skill Security Auditor detect?

The auditor detects **command injection** via `os.system` and `subprocess(shell=True)`, **credential harvesting** from SSH keys and environment variables, **obfuscation** through base64 decoding, **network exfiltration** via unauthorized HTTP requests, **file-system abuse** outside the skill directory, and **supply-chain attacks** through dependency typosquatting.

### How do I audit a Claude skill without installing it first?

Download the skill source to a temporary directory (e.g., `~/.claude/skills/temp-review/`) and run `python3 engineering/skill-security-auditor/scripts/skill_security_auditor.py` against that path. The auditor analyzes static files without executing any code, ensuring zero risk during inspection.

### Can I integrate the security auditor into my CI/CD pipeline?

Yes. Import the `scan_skill` and `print_report` functions from [`skill_security_auditor.py`](https://github.com/alirezarezvani/claude-skills/blob/main/skill_security_auditor.py) into your Python validation scripts. The tool uses only standard library modules, so it runs in minimal containers without internet access or pip dependencies.

### What should I do if a skill fails the security audit?

Immediately delete the skill directory without installing it. Review the audit report for CRITICAL findings such as `eval()` calls or credential theft attempts. If the skill is from the official marketplace, open a security issue referencing the specific file paths and line numbers flagged by the auditor.