How to Perform Security Auditing on Claude Skills Before Installation

Run the zero-dependency Skill Security Auditor on any Claude skill directory to detect command injection, credential harvesting, and supply-chain risks before executing installation commands.

The alirezarezvani/claude-skills repository provides a modular marketplace of production-ready skill packages that extend Claude AI capabilities across engineering, product, and executive domains. Because these skills execute Python scripts and CLI commands on your local machine, security auditing Claude skills before installation is a mandatory step to prevent credential theft, malware injection, and data exfiltration. The repository includes a purpose-built auditor that scans for critical vulnerabilities without requiring external dependencies.

The Skill Security Auditor Architecture

The repository includes a dedicated Skill Security Auditor located at engineering/skill-security-auditor/scripts/skill_security_auditor.py. This pure-Python tool uses only the standard library, ensuring it runs on any system with Python 3 regardless of the target skill's dependencies.

Detection Patterns and Severity Levels

The auditor scans for six critical vulnerability categories:

• Command Injection & Code Execution – Detects os.system, subprocess(..., shell=True), eval, and exec calls marked as CRITICAL severity.
• Credential Harvesting – Flags attempts to access ~/.ssh private keys or read sensitive environment variables like os.environ["API_KEY"] as CRITICAL.
• Obfuscation Techniques – Identifies base64.b64decode, hex string decoding, and other payload hiding methods as CRITICAL.
• Network Exfiltration – Catches unauthorized requests.post, urllib calls, and socket.connect attempts as CRITICAL.
• File-System Abuse – Warns on writes to /etc, symlinks pointing outside the skill directory, and unauthorized system modifications as HIGH or CRITICAL.
• Dependency Risks – Scans requirements.txt for typosquatting (e.g., reqeusts instead of requests) and unpinned versions as HIGH or INFO.

Verdict System

After analysis, the auditor assigns a PASS, WARN, or FAIL verdict. Only PASS-rated skills should be installed into your Claude environment. The tool outputs a formatted report showing exact file paths, line numbers, and remediation steps for any flagged issues.

Pre-Installation Security Audit Workflow

Follow this sequence before adding any skill to Claude Code:

1. Download the skill source without executing installation scripts.
2. Run the Skill Security Auditor against the skill directory.
3. Review the report for CRITICAL or HIGH severity findings.
4. Remediate or reject the skill if the verdict is FAIL.
5. Install only after achieving a PASS verdict.

Running the Auditor via CLI

Execute the auditor directly from the repository against your target skill:

python3 engineering/skill-security-auditor/scripts/skill_security_auditor.py \
    ~/.claude/skills/suspicious-skill-package

Typical successful output appears as:

╔═════════════════════════════════════════════════════════════════════╗
║  SKILL SECURITY AUDIT REPORT                                      ║
║  Skill: suspicious-skill-package                                  ║
║  Verdict: ✅ PASS                                                 ║
╠═════════════════════════════════════════════════════════════════════╣
║  🔴 CRITICAL: 0  🟡 HIGH: 0  ⚪ INFO: 2                               ║
║  Files: 12  Scripts: 5  Markdown: 2                                 ║
╚═════════════════════════════════════════════════════════════════════╝

Programmatic Integration

Embed the auditor into your own validation pipelines by importing the core functions:

from pathlib import Path
from engineering.skill_security_auditor.scripts.skill_security_auditor import scan_skill, print_report

skill_path = Path.home() / ".claude" / "skills" / "unverified-skill"
report = scan_skill(skill_path)
print_report(report)  # Uses the CLI formatter for consistent output

Detecting Typosquatting Attacks

If a skill's requirements.txt contains a malicious typo like reqeusts==2.31.0 instead of requests, the auditor flags it immediately:

🟡 HIGH [DEPS-TYPOSQUAT] requirements.txt:1
   Pattern: reqeusts==2.31.0
   Risk: Possible typosquatting — did you mean 'requests'?
   Fix: Verify package name. Likely should be 'requests'

Correct the dependency name and re-run the audit until the report shows zero HIGH or CRITICAL findings.

Repository Security Standards and CI Validation

The alirezarezvani/claude-skills repository enforces organization-wide security through mandatory standards and automated pipeline checks documented in standards/security/security-standards.md.

Security Standards Compliance

All skills must adhere to these non-negotiable rules:

• No hard-coded secrets – Credentials must use environment variable references only.
• Pinned dependencies – All requirements.txt entries must specify exact versions with hash verification.
• Safe subprocess usage – Shell execution is prohibited; all system calls must use argument lists.

Continuous Integration Scans

Every pull request triggers automated security validation via GitHub Actions:

• VirusTotal Scan – The entire repository uploads to VirusTotal for malware detection (.github/workflows/virustotal-scan.yml).
• Bandit Linting – Static analysis runs via Bandit to catch Python security anti-patterns (.github/workflows/ci-quality-gate.yml).

Only skills that pass both CI gates and manual auditor review are eligible for inclusion in the marketplace manifest at .claude-plugin/marketplace.json.

Manual Inspection Red Flags

While the automated auditor catches most threats, manually review these components before installation:

• SKILL.md frontmatter – Verify the author and version match the marketplace entry.
• scripts/ directory – Ensure all Python files use standard library imports only unless explicitly required.
• assets/ templates – Check Dockerfiles and CI configs for malicious base images or credential exfiltration steps.

Summary

• Always audit first – Run skill_security_auditor.py on any skill before installation to catch command injection, credential harvesting, and network exfiltration attempts.
• Zero-dependency scanning – The auditor requires only Python 3 and works offline, making it safe to run on air-gapped systems.
• Enforce repository standards – Verify skills comply with standards/security/security-standards.md and have passed CI security gates.
• Reject non-PASS verdicts – Never install skills rated FAIL or WARN without first remediating all CRITICAL and HIGH severity findings.

Frequently Asked Questions

What specific threats does the Skill Security Auditor detect?

The auditor detects command injection via os.system and subprocess(shell=True), credential harvesting from SSH keys and environment variables, obfuscation through base64 decoding, network exfiltration via unauthorized HTTP requests, file-system abuse outside the skill directory, and supply-chain attacks through dependency typosquatting.

How do I audit a Claude skill without installing it first?

Download the skill source to a temporary directory (e.g., ~/.claude/skills/temp-review/) and run python3 engineering/skill-security-auditor/scripts/skill_security_auditor.py against that path. The auditor analyzes static files without executing any code, ensuring zero risk during inspection.

Can I integrate the security auditor into my CI/CD pipeline?

Yes. Import the scan_skill and print_report functions from skill_security_auditor.py into your Python validation scripts. The tool uses only standard library modules, so it runs in minimal containers without internet access or pip dependencies.

What should I do if a skill fails the security audit?

Immediately delete the skill directory without installing it. Review the audit report for CRITICAL findings such as eval() calls or credential theft attempts. If the skill is from the official marketplace, open a security issue referencing the specific file paths and line numbers flagged by the auditor.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}