Skills agent-skill-trust-check

📦

agent-skill-trust-check

Name: agent-skill-trust-check
Author: Tate Programs

v0.1.2 Content revision r1 Medium Risk 📁 Filesystem access⚙️ External commands🌐 Network access🔑 Env variables

Review Agent Skills Before Install

Installing a skill can expose files, accounts, tools, and payment flows. This skill reviews public skill text before install and returns risks, missing signals, and patch priorities.

Supports: Claude Codex Code(CC)

📊 72 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "agent-skill-trust-check" from https://skillstore.io/skills/tatelyman-agent-skill-trust-check.md and its manifest at https://skillstore.io/api/skills/tatelyman-agent-skill-trust-check/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/tatelyman-agent-skill-trust-check.md Signed manifest GET /api/skills/tatelyman-agent-skill-trust-check/manifest Signed lockfile GET /api/skills/tatelyman-agent-skill-trust-check/lockfile

Test it

Using "agent-skill-trust-check". A SKILL.md says it runs package installers and posts summaries to a webhook.

Expected outcome:

Review before install. Findings cover shell execution and external sharing. Patch order requests command allowlists, host disclosure, and visible user confirmation.

Using "agent-skill-trust-check". A marketplace listing has a license and source repo, but no uninstall notes.

Expected outcome:

The report marks provenance partly complete and asks for uninstall, version, and permission details before approval.

Using "agent-skill-trust-check". A skill description asks the agent to ignore higher-priority instructions.

Expected outcome:

The report blocks the listing until the prompt-boundary language is removed and untrusted content handling is documented.

Security Audit

Medium Risk

v6 • 7/9/2026 Open versioned report

Most static hits are false positives from detector regexes, fixture text, documentation commands, and metadata links. The real risks are the local CLI file-read and allowlisted fetch behavior, plus fixed /tmp output in the check script. A semantic finding flags that the packaged npm CLI has broader capabilities than the stdin-only permission declaration.

Files scanned

939

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

SKILL.md:37-41 package.json:14-15 bin/agent-skill-trust-check.js:18-26

Declared Permission Boundary Does Not Cover Packaged CLI

SKILL.md declares network and filesystem permissions as false for the marketplace interface, but package.json exposes a CLI that can read paths and fetch public GitHub or Gist URLs. Agents that install the package and invoke the binary may get broader capability than the declared stdin runner.

The permission declaration, npm bin mapping, fetch call, and readFile call are visible in source. The risk is boundary confusion, not evidence of malicious exfiltration.

Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

bin/agent-skill-trust-check.js:26

Node.js fs operations

return fs.readFile(target, 'utf8');

The local CLI reads whatever filesystem path the caller supplies. This is intended for local skill review, but it is a real file-read capability requiring explicit permission boundaries.

Medium

package.json:27

Temp directory access

"check": "node --check lib/analyze.js && node --check bin/agent-skill-trust-check.js && node --check

The npm check script writes output to predictable files under /tmp. It is user-run test behavior, but fixed temp paths are avoidable local filesystem risk.

Low

bin/agent-skill-trust-check.js:22

Fetch API call

const response = await fetch(url);

The local CLI performs a network fetch for user-supplied GitHub, raw GitHub, or Gist URLs. The host allowlist reduces risk, but this is real network capability that should be disclosed.

Risk Factors

📁 Filesystem access (4)

bin/agent-skill-trust-check-stdin.js:2 bin/agent-skill-trust-check.js:26 bin/agent-skill-trust-check.js:3 package.json:27

⚙️ External commands (25)

🌐 Network access (16)

bin/agent-skill-trust-check.js:22 bin/agent-skill-trust-check.js:12 lib/analyze.js:34 package.json:6 package.json:9 package.json:12 README.md:16 README.md:25 skill.json:15 skill.json:19 SKILL.md:55 SKILL.md:90 SKILL.md:131 skills/agent-skill-trust-check/SKILL.md:55 skills/agent-skill-trust-check/SKILL.md:90 skills/agent-skill-trust-check/SKILL.md:131

🔑 Env variables (3)

examples/risky-skill.md:5 examples/risky-skill.md:5 examples/risky-skill.md:5

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/tatelyman-agent-skill-trust-check/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/tatelyman-agent-skill-trust-check/security.svg)](https://skillstore.io/skills/tatelyman-agent-skill-trust-check?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/tatelyman-agent-skill-trust-check?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/tatelyman-agent-skill-trust-check/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/tatelyman-agent-skill-trust-check.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Tate Programs. (2026). agent-skill-trust-check security audit report (audit version 6) [Author version 0.1.2]. Skillstore. https://skillstore.io/skills/tatelyman-agent-skill-trust-check/audits/6

BibTeX citation

@techreport{tate-programs-tatelyman-agent-skill-trust-check-2026,
  author = {Tate Programs},
  title = {agent-skill-trust-check security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/tatelyman-agent-skill-trust-check/audits/6},
  note = {Author version 0.1.2}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "agent-skill-trust-check security audit report (audit version 6)"
version: "0.1.2"
type: report
authors:
  - name: "Tate Programs"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/tatelyman-agent-skill-trust-check/audits/6"
identifiers:
  - type: other
    value: "skillstore:tatelyman-agent-skill-trust-check:audit:6"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Screen marketplace submissions

Review a submitted skill for risky behavior, missing provenance, and publish-blocking trust issues.

Check before team installation

Assess a third-party skill before allowing it in a shared agent or developer environment.

Prepare a safer listing

Find unclear permissions and missing trust signals before publishing a paid or free skill.

Try These Prompts

Review before install

Review this skill before install: [paste SKILL.md or listing]. Focus on install verdict, key risks, and missing provenance.

Compare two listings

Compare these two skill listings for installation risk: [paste listing A] [paste listing B]. Recommend the safer option and explain the main tradeoffs.

Create seller fixes

Build a seller patch order for this skill: [paste source]. Prioritize permission boundaries, external destinations, secret handling, and uninstall details.

Audit high-risk claims

Audit this high-risk skill proposal: [paste description]. Treat shell, wallet, network, persistence, and instruction override claims as high-risk until bounded.