Name: skill-safety-scanner
Author: skillscatalog

About

Imported from skillscatalog/registry (skills/skill-safety-scanner/SKILL.md). Install upstream with npx skills add skillscatalog/registry --skill skill-safety-scanner. Copyright stays with the author (MIT).

Instructions

Use this skill to run safety scans on any Agent Skill directory before publishing. The scanner detects:

Secrets - Hardcoded API keys, tokens, passwords, private keys
Dangerous Code - eval(), exec(), command injection, XSS patterns
Permissions - Required capabilities (filesystem, network, subprocess, etc.)

When to Use

Before submitting a skill for publication
To preview what the catalog safety scan will find
To identify and fix security issues early
As part of CI/CD pipelines

How to Use

Scan a skill directory:

Scan the skill at /path/to/my-skill for safety issues

Get detailed output:

python3 safety_scan.py /path/to/my-skill --verbose

Get JSON output for CI integration:

python3 safety_scan.py /path/to/my-skill --json

Output

Safety Scan Report
  Skill: my-skill
  Grade: B (85/100)

  Scores:
    Secrets: 100/100
    Dangerous Code: 70/100

  Permissions Detected:
    - filesystem
    - network

  Findings (1):
    [medium] Potential command injection
      File: scripts/main.py:42
      Code: subprocess.run(cmd, shell=True)

  Recommendation: Review the finding above before publishing.

Examples

Basic scan:

User: Scan my skill at ./document-tools for safety issues
Agent: Running safety scan on ./document-tools...

       Grade: A (95/100)
       No critical issues found.

Finding secrets:

User: Check ./my-api-client for security issues
Agent: Running safety scan...

       Grade: F (0/100)

       Findings:
         [critical] Hardcoded API key detected
           File: config.py:5
           Code: API_KEY = "sk-ant-..."

       You must remove this secret before publishing.

Limitations

Does not scan dependencies (use npm audit / pip-audit separately)
Pattern-based detection may have false positives
Cannot detect all security issues (not a replacement for security review)
Scans local files only (not GitHub URLs)

Dependencies

Python 3.9+
No external dependencies (uses Python stdlib)

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/skillscatalog-registry-skill-safety-scanner/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

skillscatalog-registry-skill-safety-scanner.ocm.jsonjson

{
  "ocm": "1",
  "id": "skillscatalog-registry-skill-safety-scanner",
  "kind": "skill",
  "name": "skill-safety-scanner",
  "description": "Run local safety scans on Agent Skills before publishing. Detects secrets, dangerous code patterns, and analyzes required permissions.",
  "publisher": "skillscatalog",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "safety",
      "security",
      "scanning",
      "validation",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Run local safety scans on Agent Skills before publishing. Detects secrets, dangerous code patterns, and analyzes required permissions."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/skillscatalog/registry",
      "path": "skills/skill-safety-scanner/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/skillscatalog/registry/blob/HEAD/skills/skill-safety-scanner/SKILL.md",
      "key": "skillscatalog/registry/skills/skill-safety-scanner/SKILL.md"
    },
    "license": "MIT"
  },
  "instructions": "## Instructions\n\nUse this skill to run safety scans on any Agent Skill directory before publishing. The scanner detects:\n\n- **Secrets** - Hardcoded API keys, tokens, passwords, private keys\n- **Dangerous Code** - eval(), exec(), command injection, XSS patterns\n- **Permissions** - Required capabilities (filesystem, network, subprocess, etc.)\n\n### When to Use\n\n- Before submitting a skill for publication\n- To preview what the catalog safety scan will find\n- To identify and fix security issues early\n- As part of CI/CD pipelines\n\n### How to Use\n\nScan a skill directory:\n\n```\nScan the skill at /path/",
  "cost": {
    "context_tokens": 515
  }
}

Fetch it by URL: GET /api/v1/registry/skillscatalog-registry-skill-safety-scanner/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.