[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6KS88MBRYZ2M8TZSYPVV8GQ":3,"skill-same:01M6KS88MBRYZ2M8TZSYPVV8GQ":64},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":34,"linkOnly":35,"markdownContent":36,"markdownBody":37,"frontMatter":38,"refName":42,"commitSha":43,"skillDirectory":44,"forksCount":45,"repositoryHtmlUrl":46,"repositoryHomepageUrl":6,"ownerHtmlUrl":47,"ownerBlogUrl":6,"ownerDescription":48,"updatedAt":49,"install":50,"resources":63},"01M6KS88MBRYZ2M8TZSYPVV8GQ","audit",null,"Run SkillGuard security audit on AI agent skills — scans 10 dimensions with 109 rules based on OWASP LLM Top 10, SLSA, and Google SAIF","openmaster-ai\u002Fskillguard-cli","openmaster-ai","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F269944371?v=4","01M6KS862ZX1BTMRHNSRN9AV4R","OpenMaster","01M6KS867SMAHB6VS0RKYAZ8ND",1,"MIT","https:\u002F\u002Fgithub.com\u002Fopenmaster-ai\u002Fskillguard-cli\u002Fblob\u002Fmaster\u002Fskills\u002Faudit\u002FSKILL.md",[],[5,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33],"google","security","ai agent","owasp llm","run","owasp","slsa","security audit","Bash","Rules","read","skillguard","dimensions","with","top","2026-11-10 10:12:30",false,"---\ndescription: Run SkillGuard security audit on AI agent skills — scans 10 dimensions with 109 rules based on OWASP LLM Top 10, SLSA, and Google SAIF\nallowed-tools:\n  - Bash\n  - Read\n  - Glob\n---\n\n# SkillGuard Audit\n\nSecurity audit tool for Claude Code Skills and AI agent plugins. Scans across 10 security dimensions with 109 detection rules, providing A–F risk grading and token cost estimation.\n\n## Quick Start\n\n```bash\n# Scan a local skill directory\nnpx skillguard \u002Fpath\u002Fto\u002Fskill\n\n# Scan a GitHub repository\nnpx skillguard https:\u002F\u002Fgithub.com\u002Fowner\u002Frepo\n\n# Scan a ClawHub skill\nnpx skillguard https:\u002F\u002Fclawhub.ai\u002Fauthor\u002Fskill-name\n\n# Scan all skills in a marketplace directory\nnpx skillguard \u002Fpath\u002Fto\u002Fmarketplace --all\n```\n\n## Output Formats\n\n```bash\n# Terminal output (default) — colored, human-readable\nnpx skillguard \u003Ctarget>\n\n# JSON output to stdout\nnpx skillguard \u003Ctarget> --json\n\n# JSON output to file\nnpx skillguard \u003Ctarget> --json report.json\n\n# Markdown report\nnpx skillguard \u003Ctarget> --md report.md\n\n# Chinese language output\nnpx skillguard \u003Ctarget> --lang zh\n```\n\n## Options\n\n- `--all` — Scan all skill subdirectories (marketplace mode)\n- `--json [file]` — Output as JSON (to stdout or file)\n- `--md \u003Cfile>` — Output as Markdown report\n- `--rules \u003Cpath>` — Custom rules.yaml file\n- `--min-level \u003CA-F>` — Filter output by minimum risk level\n- `--min-severity \u003Cseverity>` — Filter by minimum severity (CRITICAL, HIGH, MEDIUM, LOW, INFO)\n- `--lang \u003Cen|zh>` — Output language (default: en)\n\n## 10 Security Dimensions\n\n1. **Prompt Injection** — Direct\u002Findirect injection patterns, zero-width chars, base64 payloads\n2. **Permission Escalation** — Sandbox bypass, sudo, chmod 777, dangerous tool combos\n3. **Data Exfiltration** — Credential theft, env leaks, outbound HTTP\n4. **Destructive Operations** — rm -rf, DROP TABLE, git reset --hard\n5. **Supply Chain** — Pipe-to-shell, unpinned deps, Docker without digest\n6. **Code Security** — eval(), shell=True, SQL injection, XSS\n7. **Credential Leaks** — Hardcoded API keys, JWT tokens, PEM keys\n8. **Least Privilege** — Missing allowed-tools, dangerous tool combinations\n9. **License Compliance** — Proprietary restrictions, non-commercial clauses\n10. **Resource Abuse** — Infinite loops, excessive retries, unbounded fetching\n\n## Risk Grading\n\n| Grade | Score | Meaning |\n|-------|-------|---------|\n| A | 0–9 | Safe |\n| B | 10–29 | Acceptable |\n| C | 30–49 | Warning |\n| D | 50–69 | Unsafe |\n| F | 70–100 | Dangerous |\n\n## Example Workflow\n\nWhen a user asks to audit a skill:\n\n1. Run `npx skillguard \u003Ctarget>` to get the terminal report\n2. If the user wants details, use `--json report.json` and read the JSON file\n3. Explain findings in context — what each risk means and whether it's a real threat\n4. Suggest concrete fixes using the remediation guidance in each finding\n","# SkillGuard Audit\n\nSecurity audit tool for Claude Code Skills and AI agent plugins. Scans across 10 security dimensions with 109 detection rules, providing A–F risk grading and token cost estimation.\n\n## Quick Start\n\n```bash\n# Scan a local skill directory\nnpx skillguard \u002Fpath\u002Fto\u002Fskill\n\n# Scan a GitHub repository\nnpx skillguard https:\u002F\u002Fgithub.com\u002Fowner\u002Frepo\n\n# Scan a ClawHub skill\nnpx skillguard https:\u002F\u002Fclawhub.ai\u002Fauthor\u002Fskill-name\n\n# Scan all skills in a marketplace directory\nnpx skillguard \u002Fpath\u002Fto\u002Fmarketplace --all\n```\n\n## Output Formats\n\n```bash\n# Terminal output (default) — colored, human-readable\nnpx skillguard \u003Ctarget>\n\n# JSON output to stdout\nnpx skillguard \u003Ctarget> --json\n\n# JSON output to file\nnpx skillguard \u003Ctarget> --json report.json\n\n# Markdown report\nnpx skillguard \u003Ctarget> --md report.md\n\n# Chinese language output\nnpx skillguard \u003Ctarget> --lang zh\n```\n\n## Options\n\n- `--all` — Scan all skill subdirectories (marketplace mode)\n- `--json [file]` — Output as JSON (to stdout or file)\n- `--md \u003Cfile>` — Output as Markdown report\n- `--rules \u003Cpath>` — Custom rules.yaml file\n- `--min-level \u003CA-F>` — Filter output by minimum risk level\n- `--min-severity \u003Cseverity>` — Filter by minimum severity (CRITICAL, HIGH, MEDIUM, LOW, INFO)\n- `--lang \u003Cen|zh>` — Output language (default: en)\n\n## 10 Security Dimensions\n\n1. **Prompt Injection** — Direct\u002Findirect injection patterns, zero-width chars, base64 payloads\n2. **Permission Escalation** — Sandbox bypass, sudo, chmod 777, dangerous tool combos\n3. **Data Exfiltration** — Credential theft, env leaks, outbound HTTP\n4. **Destructive Operations** — rm -rf, DROP TABLE, git reset --hard\n5. **Supply Chain** — Pipe-to-shell, unpinned deps, Docker without digest\n6. **Code Security** — eval(), shell=True, SQL injection, XSS\n7. **Credential Leaks** — Hardcoded API keys, JWT tokens, PEM keys\n8. **Least Privilege** — Missing allowed-tools, dangerous tool combinations\n9. **License Compliance** — Proprietary restrictions, non-commercial clauses\n10. **Resource Abuse** — Infinite loops, excessive retries, unbounded fetching\n\n## Risk Grading\n\n| Grade | Score | Meaning |\n|-------|-------|---------|\n| A | 0–9 | Safe |\n| B | 10–29 | Acceptable |\n| C | 30–49 | Warning |\n| D | 50–69 | Unsafe |\n| F | 70–100 | Dangerous |\n\n## Example Workflow\n\nWhen a user asks to audit a skill:\n\n1. Run `npx skillguard \u003Ctarget>` to get the terminal report\n2. If the user wants details, use `--json report.json` and read the JSON file\n3. Explain findings in context — what each risk means and whether it's a real threat\n4. Suggest concrete fixes using the remediation guidance in each finding\n",{"description":7,"allowed-tools":39},[27,40,41],"Read","Glob","master","9fd25469bd9024221a0dad7180338fc69731525c","skills\u002Faudit",0,"https:\u002F\u002Fgithub.com\u002Fopenmaster-ai\u002Fskillguard-cli","https:\u002F\u002Fgithub.com\u002Fopenmaster-ai","One Platform. Every Master.","2026-04-04 14:32:39",{"source":8,"skillName":5,"commands":51,"prompt":61,"zipAvailable":62},[52,55,58],{"tool":53,"command":54},"npx","npx skills add openmaster-ai\u002Fskillguard-cli --skill audit",{"tool":56,"command":57},"bunx","bunx skills add openmaster-ai\u002Fskillguard-cli --skill audit",{"tool":59,"command":60},"pnpm","pnpm dlx skills add openmaster-ai\u002Fskillguard-cli --skill audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fopenmaster-ai\u002Fskillguard-cli\u002Fblob\u002Fmaster\u002Fskills\u002Faudit\u002FSKILL.md",true,[],[65,82,97],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":76,"publishedAt":34},"01M6KS8M67XTSF6T078R7NBKCC","sample-skill","Test skill for SkillGuard","https:\u002F\u002Fgithub.com\u002Fopenmaster-ai\u002Fskillguard-cli\u002Fblob\u002Fmaster\u002Ftests\u002Ffixtures\u002Fsample-skill\u002FSKILL.md",[71],{"categoryNo":72,"categoryName":73,"taxonomyType":74,"taxonomyTypeDesc":75},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[77,78,79,80,81,27,29,30],"sample","sample skill","for","test","Test Skill",{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":88,"publishedAt":34},"01M6KS8GZK4RSM25NEVE78MMSE","suggest-fixes","Suggest concrete code fixes for SkillGuard security findings — generate remediation patches","https:\u002F\u002Fgithub.com\u002Fopenmaster-ai\u002Fskillguard-cli\u002Fblob\u002Fmaster\u002Fskills\u002Fsuggest-fixes\u002FSKILL.md",[],[89,90,91,29,92,93,30,79,27,20,94,95,96],"suggest fixes","fixes","grep","write","edit","generate","code","remediation",{"skillNo":98,"name":99,"nameZh":6,"description":100,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":108,"publishedAt":34},"01M6KS8DG69PJPT7CSNPK26J6J","explain-report","Explain a SkillGuard security audit report — analyze findings, assess real risk vs false positives, and provide context","https:\u002F\u002Fgithub.com\u002Fopenmaster-ai\u002Fskillguard-cli\u002Fblob\u002Fmaster\u002Fskills\u002Fexplain-report\u002FSKILL.md",[103],{"categoryNo":104,"categoryName":105,"taxonomyType":106,"taxonomyTypeDesc":107},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[109,110,111,20,112,5,113,114,26,27,115,91,29,30,116,117],"report","explain","explain report","context","audit report","risk","analyze","false","assess"]