Skill Security

Skill Security is an open source toolkit for security scanning of AI skills, starting with a Cursor-style skill that uses an LLM to review SKILL.md definitions for potential issues.

Features

• Skill-focused security scan: Analyze SKILL.md files with an LLM to surface potential risks and anti-patterns.
• Skills-only repo: No compiled app or service; everything is driven by skills and markdown.
• Extensible roadmap: Designed to evolve with deeper analysis, more cases, and additional security checks over time.

Installation

This project is distributed as a skill via the skills CLI, not as a library or service.

Install the Skill Security skill:

npx skills add slior/skill-security

or for specifically the security scan skill:

npx skills add slior/skill-security --skill skill-security-scan 

The skills CLI will download the skill and configure it for use with your AI agent.
For more details, see the skills CLI reference.

Usage

Once installed via npx skills add slior/skill-security, the Skill Security scan can be invoked from any supported agent that understands skills (e.g., Cursor):

1. Open the target repository in your agent.
2. Run the installed Skill Security Scan skill.
3. Point it at one or more SKILL.md files you want to review.
4. Inspect the generated analysis for potential security, privacy, or misuse concerns.

For a deeper look at how the skill behaves, see:

• .cursor/skills/security-scan/SKILL.md

Project Layout

• .cursor/skills/** – All skill definitions for this repo
  • .cursor/skills/security-scan/SKILL.md – Main security scan skill
  • .cursor/skills/agents-md-generator/SKILL.md – Helper skill for AGENTS documentation
• AGENTS.md – Agent-oriented documentation for working in this repo

There is no build step and no runtime service – skills are consumed directly by AI agents.

Roadmap

Current scope:

• LLM-based skill scanning only, focused on SKILL.md security analysis.

Planned evolution:

• More security cases and patterns
• Deeper analysis passes
• Additional helper skills for broader security workflows

Expect the skill’s behavior and coverage to evolve over time.

Contributing

Contributions are welcome!

• Issues: File bugs, feature requests, or ideas for new security checks.
• PRs: Keep changes focused and align with the conventions in AGENTS.md:
  • Treat each SKILL.md as the single source of truth.
  • Keep prompts concise and security-focused.
  • Avoid introducing destructive, exfiltrative, or self-propagating behavior.

Before opening a PR, please:

1. Run the security scan skill against your changes where relevant.
2. Ensure markdown renders cleanly and commands are copy-paste ready.

Developing Locally

If you want to work on the skills in this repo:

git clone https://github.com/slior/skill-security
cd skill-security

# Explore skills
ls .cursor/skills

You can then iterate on the skill definitions and re-publish/update them through your normal skills distribution flow.

License

This project is licensed under the MIT License as specified in the LICENSE file.