S Skillteca
Receber por email
Explorar Categorias Coleções Newsletter
← Voltar para o catálogo

agent-skill-trust-check

Segurança Autor: aiskillstore

Provenance or safety signals not found in the target text.

367estrelas
Atualizado há 4 meses
Ver no GitHub ↗

Como adicionar

/plugin marketplace add aiskillstore/marketplace

O comando exato pode variar conforme o repositório. Confira o README no GitHub.

Para o autor da skill

Cole no README do seu repo

Mostra que sua skill está catalogada na Skillteca, gera backlink e tráfego rastreável.

[![Skillteca](https://www.skillteca.com.br/api/badge/agent-skill-trust-check/svg)](https://www.skillteca.com.br/skills/agent-skill-trust-check)

Skills relacionadas

Ver todas de Segurança →

security-research

63k

Habilidade de pesquisa de segurança em Modo Equipe que orquestra 3 caçadores de vulnerabilidades e 2 engenheiros de PoC para auditar um código, provar explorabilidade, classificar causas raiz e calibrar a severidade. É utilizada para revisão de segurança, pesquisa de vulnerabilidades, auditoria de explorabilidade e validação de modelo de ameaças.

Segurança por code-yeongyu

security-scanning-security-dependencies

41.2k

You are a security expert specializing in dependency vulnerability analysis, SBOM generation, and supply chain security. Scan project dependencies across multiple ecosystems to identify vulnerabilities, assess risks, and provide automated remediation strategies.

Segurança #ai #git por sickn33

vulnerability-scanner

41.2k

Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.

Segurança #ai #git por sickn33

dependency-management-deps-audit

41.2k

You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.

Segurança #ai #git por sickn33

Alerta por categoria

Receba novas skills de Segurança toda segunda

1 email curto, só com as skills novas de Segurança. 4 minutos de leitura, sem spam, cancela com 1 clique.

Você confirma o email no primeiro envio. Sem spam. Cancela com 1 clique.

Ler descrição completa

Agent Skill Trust Check

Use this skill before installing a third-party agent skill, SKILL.md package, MCP-linked skill, or marketplace listing.

What This Skill Does

  • Reads a public or local skill description before install.
  • Flags patterns that deserve review: shell execution, destructive commands, secrets, wallet/payment actions, network output, persistence, and prompt-boundary issues.
  • Separates basic provenance signals from risky behavior signals.
  • Produces a patch order that a maintainer can resolve before the skill is trusted.

When To Use

Use this when an agent is about to install or recommend a skill from:

  • OpenClaw, Hermes, or ClawHub-style marketplaces.
  • Claude Code, Codex, Cursor, Windsurf, or Gemini skill directories.
  • MCP-linked skill bundles.
  • GitHub repositories that include a SKILL.md, tool manifest, or install script.

Run From The Public Repo

git clone https://github.com/TateLyman/agent-skill-trust-check.git
cd agent-skill-trust-check
npm run check
node bin/agent-skill-trust-check.js ./SKILL.md

Marketplace-safe stdin mode:

node bin/agent-skill-trust-check-stdin.js < ./SKILL.md

For JSON output:

node bin/agent-skill-trust-check.js ./SKILL.md --json

npm command:

npx --yes agent-skill-trust-check ./SKILL.md --json

Review Rules

Before installation, check:

  • Does the skill run shell commands, package installers, or process-spawn APIs?
  • Does it read secrets, environment variables, wallet data, credentials, cookies, or private keys?
  • Does it send content to remote URLs or webhooks?
  • Does it create persistent background jobs?
  • Does it ask the agent to ignore or override higher-priority instructions?
  • Does it document source, license, version, tests, permissions, and uninstall steps?

Boundaries

This is a static pre-install check. The marketplace-safe runner reads only stdin and returns JSON. The local CLI can also read a local path or a public GitHub/raw/Gist URL when run from the repository checkout. Neither mode executes the target skill or proves the runtime is safe.

For marketplace-grade review, use the paid Agent Skill Trust Check listing:

https://orkai.ai/skills/agent-skill-trust-check

Compartilhar X LinkedIn