skillcheck - Security scanner for Claude SKILL.md files. Detect

项目说明

SkillCheck for Claude Skills

Security scanner for Claude SKILL.md files. Detects before they reach production.

Features

Hardcoded Secrets Detection - Finds API keys, tokens, passwords, and credentials

Command Injection Detection - Identifies unsafe shell command execution

Path Tra Detection - Catches directory tra

Smart False Positi - Context-aware analysis and placeholder detection

Beautiful CLI Output - Color-coded, actionable security reports

Installation

Or for de:

Usage

Scan a single file

Scan a directory

Configure failure threshold

Generate SARIF output for GitHub Security

Security Rules

CRITICAL Se

Hardcoded Secrets (SECRET_EXPOSURE_001)

Detects: AWS keys, API keys, JWT tokens, private keys, GitHub tokens

Excludes: Placeholders like your_api_key_here, ${API_KEY}, XXXX

CWE-798

Command Injection (CMD_INJECTION_001)

Detects: Unsafe bash, eval(), exec(), os.system() with user input

Context-aware: Skips when code is present nearby

CWE-78

Pri Escalation (PRI)

Detects: sudo, setuid/setgid, chmod 777, su, pkexec, doas, kernel module loading, Docker socket access, system file modifications

Context-aware: Skips when authorization checks are present nearby

CWE-250

HIGH Se

Path Tra (PATH_TRA)

Detects: ../ sequences, file operations with un user paths

Context-aware: Skips when path.resolve() or exists

CWE-22

Information Disclosure (INFO_DISCLOSURE_001)

Detects: SSH keys, AWS credentials, .env files, /etc/passwd, en , database dumps, browser cookies, Git credentials, connection strings, process lists

Context-aware: Skips when redaction/filtering code is present nearby

CWE-200

Output Formats

Console (default)

Human-readable output with color-coded se levels. Best for local de and interactive use.

SARIF

Machine-readable JSON format compatible with GitHub Code Scanning and other security platforms. Use this for CI/CD integration.

You can upload SARIF results to GitHub Security tab using:

Exit Codes

0 - No issues found (or below fail threshold)

1 - Security issues found at or above fail threshold

De

Run tests

Run tests in watch mode

Build

Lint

Examples

Skill (Will Fail)

Output:

Secure Skill (Will Pass)

Output:

Architecture

Parser - Extracts structure from skill.md files, identifies code blocks

Scanner - Orchestrates rule execution, filters false positives

Rules - Modular security checks with context-aware analysis

Reporters - Multiple output formats (console, SARIF)

CLI - Command-line interface for local and CI usage

Future Enhancements

[x] SARIF output format for GitHub Security tab

[x] Pri escalation detection

[x] Information disclosure detection

[ ] JSON output format

[ ] GitHub Actions workflow

[ ] Configuration file support

[ ] Custom rule definitions

[ ] VS Code extension

Built by Agentigy — securing AI agents and workflows.

License

MIT

项目信息

开发语言：TypeScript

Star 数：11

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Security scanner for Claude SKILL.md files. Detects vulnerabilities before they reach production.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。