ai-skill-audit — Why you need it

# `ai-skill-audit`

The linter for AI skills. Quality scoring + security scanning in one tool.

## The problem

80,000+ community skills are circulating across Claude Code, Cursor, and MCP platforms. You copy-paste a config, install a skill, or browse a marketplace — and trust that it's safe.

### It often isn't.

Independent audits have found 13–37% of marketplace skills contain critical issues: prompt injection, hardcoded credentials, data exfiltration, and destructive commands hidden in otherwise normal-looking files.

37%of skills with critical issues
6leaked API keys in one popular MCP config
60+threat patterns detected

## What it catches

Prompt injection — instruction overrides, hidden tags, zero-width chars
Hardcoded secrets — AWS, GitHub, Slack, OpenAI keys
Data exfiltration — curl POST, credential file reads
Code obfuscation — base64|bash, eval, dynamic imports
Destructive commands — rm -rf, DROP TABLE, force push
MCP config risks — exposed secrets, overprivileged servers

## See it in action

Real scans of public GitHub repositories, with static analysis + LLM security review:

### MCP Config: 30 servers, 6 leaked secrets B

A popular "100-tool MCP config" with hardcoded GitHub, Slack, Discord, and API keys.

Overall risk: CRITICAL — secret_hygiene scored 0%

### Example Malicious Skill: looks normal, hides 13 attack vectors C

A crafted test skill with perfect quality scores — but trust at 0%. Hides prompt injection, credential theft, obfuscated shell execution, and destructive commands.

13 findings across 7 categories — exactly how real attacks work

### gstack: Garry Tan's 29-skill dev toolkit D

Full-stack dev skills (deploy, review, QA, canary, benchmark). Format-flexible scoring for non-dotai skills, context-aware trust scanning.

29 skills scanned, 10 doc files auto-skipped — avg score 61%

### Skill Collection: 200+ Claude skills C

Engineering, marketing, product, and C-level advisor skills. Quality issues found, no security threats.

10 skills scanned, 12 doc files auto-skipped — avg score 65%

## Get started

$ `pip install ai-skill-audit`

    # Audit a skill file
    ai-skill-audit audit SKILL.md --verbose

    # Audit a GitHub repo
    ai-skill-audit audit https://github.com/user/repo --summary

    # MCP config scan
    ai-skill-audit audit mcp.json

    # Full audit with LLM review
    ai-skill-audit audit skills/ --llm --verbose

    # HTML report
    ai-skill-audit audit skills/ --output html --llm > report.html

    # CI gating
    ai-skill-audit audit skills/ --min-grade B

GitHub PyPI Full Documentation Contribute