skill-security-scan

skill-security-scan is a command-line tool designed to scan and detect security risks in Claude Skills. Before installing third-party Skills, use this tool for security review to effectively prevent malicious code from stealing data or compromising your system.

[{"step":"Install the `skill-security-scan` tool if not already installed. Run `pip install skill-security-scan` in your terminal.","tip":"Ensure you have Python 3.8+ installed. Use a virtual environment to avoid dependency conflicts."},{"step":"Locate the directory containing the Claude Skill you want to scan. For example, if the Skill is in `~/claude-skills/weather-app`, navigate to that directory in your terminal.","tip":"Use `ls` to verify the Skill's directory structure (e.g., `skills.json`, `README.md`, and Python/JavaScript files)."},{"step":"Run the security scan by executing `skill-security-scan .` in the Skill's root directory. Replace `.` with the path if scanning a different directory.","tip":"For verbose output, add the `--verbose` flag: `skill-security-scan ./my-skill --verbose`."},{"step":"Review the generated report. Address any critical or high-severity issues before installing the Skill. For example, update dependencies or refactor code to remove unsafe functions like `eval()`.","tip":"Use the `--output` flag to save the report to a file: `skill-security-scan . --output security_report.txt`."},{"step":"Re-run the scan after making fixes to confirm the issues are resolved. Repeat until the report shows no critical risks.","tip":"Integrate `skill-security-scan` into your CI/CD pipeline to automate security checks for all Skills before deployment."}]