---
slug: "skill-security"
source_type: "readme"
source_url: "https://cdn.jsdelivr.net/gh/slior/skill-security@main/README.md"
repo: "https://github.com/slior/skill-security"
source_file: "README.md"
branch: "main"
---
# Skill Security

Skill Security is an open source toolkit for **security scanning of AI skills**, starting with a Cursor-style skill that uses an LLM to review `SKILL.md` definitions for potential issues.

## Features

- **Skill-focused security scan**: Analyze `SKILL.md` files with an LLM to surface potential risks and anti-patterns.
- **Skills-only repo**: No compiled app or service; everything is driven by skills and markdown.
- **Extensible roadmap**: Designed to evolve with deeper analysis, more cases, and additional security checks over time.

## Installation

This project is distributed as a **skill** via the `skills` CLI, not as a library or service.

Install the Skill Security skill:

```bash
npx skills add slior/skill-security
```

or for specifically the security scan skill:
```bash
npx skills add slior/skill-security --skill skill-security-scan 
```

The `skills` CLI will download the skill and configure it for use with your AI agent.  
For more details, see the [skills CLI reference](https://skills.sh/docs/cli).

## Usage

Once installed via `npx skills add slior/skill-security`, the **Skill Security** scan can be invoked from any supported agent that understands skills (e.g., Cursor):

1. Open the target repository in your agent.
2. Run the installed **Skill Security Scan** skill.
3. Point it at one or more `SKILL.md` files you want to review.
4. Inspect the generated analysis for potential security, privacy, or misuse concerns.

For a deeper look at how the skill behaves, see:

- `.cursor/skills/security-scan/SKILL.md`

## Project Layout

- `.cursor/skills/**` – All skill definitions for this repo  
  - `.cursor/skills/security-scan/SKILL.md` – Main security scan skill  
  - `.cursor/skills/agents-md-generator/SKILL.md` – Helper skill for AGENTS documentation
- `AGENTS.md` – Agent-oriented documentation for working in this repo

There is **no build step** and no runtime service – skills are consumed directly by AI agents.

## Roadmap

Current scope:

- **LLM-based skill scanning only**, focused on `SKILL.md` security analysis.

Planned evolution:

- More security cases and patterns
- Deeper analysis passes
- Additional helper skills for broader security workflows

Expect the skill’s behavior and coverage to evolve over time.

## Contributing

Contributions are welcome!

- **Issues**: File bugs, feature requests, or ideas for new security checks.
- **PRs**: Keep changes focused and align with the conventions in `AGENTS.md`:
  - Treat each `SKILL.md` as the single source of truth.
  - Keep prompts concise and security-focused.
  - Avoid introducing destructive, exfiltrative, or self-propagating behavior.

Before opening a PR, please:

1. Run the security scan skill against your changes where relevant.
2. Ensure markdown renders cleanly and commands are copy-paste ready.

## Developing Locally

If you want to work on the skills in this repo:

```bash
git clone https://github.com/slior/skill-security
cd skill-security

# Explore skills
ls .cursor/skills
```

You can then iterate on the skill definitions and re-publish/update them through your normal `skills` distribution flow.

## License

This project is licensed under the MIT License as specified in the [`LICENSE`](https://github.com/slior/skill-security/tree/HEAD/LICENSE) file.