{"slug":"audit-skills","title":"audit-skills","summary":"Expert security auditor for AI Skills and Bundles. Performs non-intrusive static analysis to identify malicious patterns, data leaks, system stability risks, and obfuscated payloads across Windows, macOS, Linux/Unix, and Mobile (Android/iOS).","platform":"ChatGPT","tags":["security"],"authorName":"LLM Mart","authorSlug":"llm-mart","score":0,"source":"github","price":null,"verified":false,"createdAt":"2026-08-16T13:38:17.079997Z","repo":{"url":"https://github.com/sickn33/agentic-awesome-skills","stars":46883,"forks":6831,"license":"MIT","updatedAt":"2026-09-25T05:43:16Z"},"bodyHtml":"<hr>\n<h2>name: audit-skills\ndescription: \"Expert security auditor for AI Skills and Bundles. Performs non-intrusive static analysis to identify malicious patterns, data leaks, system stability risks, and obfuscated payloads across Windows, macOS, Linux/Unix, and Mobile (Android/iOS).\"\ncategory: security\nrisk: safe\nsource: community\ndate_added: \"2026-03-07\"\nauthor: MAIOStudio\ntags: [security, audit, skills, bundles, cross-platform]\ntools: [claude, gemini, gpt, llama, mistral, etc]</h2>\n<h1>Audit Skills (Premium Universal Security)</h1>\n<h2>Overview</h2>\n<p>Expert security auditor for AI Skills and Bundles. Performs non-intrusive static analysis to identify malicious patterns, data leaks, system stability risks, and obfuscated payloads across Windows, macOS, Linux/Unix, and Mobile (Android/iOS).\n2-4 sentences is perfect.</p>\n<h2>When to Use This Skill</h2>\n<ul>\n<li>Use when you need to audit AI skills and bundles for security vulnerabilities</li>\n<li>Use when working with cross-platform security analysis</li>\n<li>Use when the user asks about verifying skill legitimacy or performing security reviews</li>\n<li>Use when scanning for mobile threats in AI skills</li>\n</ul>\n<h2>How It Works</h2>\n<h3>Step 1: Static Analysis</h3>\n<p>Performs non-intrusive static analysis to identify malicious patterns, data leaks, system stability risks, and obfuscated payloads.</p>\n<h3>Step 2: Platform-Specific Threat Detection</h3>\n<p>Analyzes code for platform-specific security issues across Windows, macOS, Linux/Unix, and Mobile (Android/iOS).</p>\n<h4>1. Privilege, Ownership &amp; Metadata Manipulation</h4>\n<ul>\n<li><strong>Elevated Access</strong>: <code>sudo</code>, <code>chown</code>, <code>chmod</code>, <code>TakeOwnership</code>, <code>icacls</code>, <code>Set-ExecutionPolicy</code>.</li>\n<li><strong>Metadata Tampering</strong>: <code>touch -t</code>, <code>setfile</code> (macOS), <code>attrib</code> (Windows), <code>Set-ItemProperty</code>, <code>chflags</code>.</li>\n<li><strong>Risk</strong>: Unauthorized access, masking activity, or making files immutable.</li>\n</ul>\n<h4>2. File/Folder Locking &amp; Resource Denial</h4>\n<ul>\n<li><strong>Patterns</strong>: <code>chmod 000</code>, <code>chattr +i</code> (immutable), <code>attrib +r +s +h</code>, <code>Deny</code> ACEs in <code>icacls</code>.</li>\n<li><strong>Global Actions</strong>: Locking or hiding folders in <code>%USERPROFILE%</code>, <code>/Users/</code>, or <code>/etc/</code>.</li>\n<li><strong>Risk</strong>: Denial of service or data locking.</li>\n</ul>\n<h4>3. Script Execution &amp; Batch Invocation</h4>\n<ul>\n<li><strong>Legacy/Batch Windows</strong>: <code>.bat</code>, <code>.cmd</code>, <code>cmd.exe /c</code>, <code>vbs</code>, <code>cscript</code>, <code>wscript</code>.</li>\n<li><strong>Unix Shell</strong>: <code>.sh</code>, <code>.bash</code>, <code>.zsh</code>, <code>chmod +x</code> followed by execution.</li>\n<li><strong>PowerShell</strong>: <code>.ps1</code>, <code>powershell -ExecutionPolicy Bypass -File ...</code>.</li>\n<li><strong>Hidden Flags</strong>: <code>-WindowStyle Hidden</code>, <code>-w hidden</code>, <code>-noprofile</code>.</li>\n</ul>\n<h4>4. Dangerous Install/Uninstall &amp; System Changes</h4>\n<ul>\n<li><strong>Windows</strong>: <code>msiexec /qn</code>, <code>choco uninstall</code>, <code>reg delete</code>.</li>\n<li><strong>Linux/Unix</strong>: <code>apt-get purge</code>, <code>yum remove</code>, <code>rm -rf /usr/bin/...</code>.</li>\n<li><strong>macOS</strong>: <code>brew uninstall</code>, deleting from <code>/Applications</code>.</li>\n<li><strong>Risk</strong>: Removing security software or creating unmonitored installation paths.</li>\n</ul>\n<h4>5. Mobile Application &amp; OS Security (Android/iOS)</h4>\n<ul>\n<li><strong>Android Tools</strong>: <code>adb shell</code>, <code>pm install</code>, <code>am start</code>, <code>apktool</code>, <code>dex2jar</code>, <code>keytool</code>.</li>\n<li><strong>Android Files</strong>: Manipulation of <code>AndroidManifest.xml</code> (permissions), <code>classes.dex</code>, or <code>strings.xml</code>.</li>\n<li><strong>iOS Tools</strong>: <code>xcodebuild</code>, <code>codesign</code>, <code>security find-identity</code>, <code>fastlane</code>, <code>xcrun</code>.</li>\n<li><strong>iOS Files</strong>: Manipulation of <code>Info.plist</code>, <code>Entitlements.plist</code>, or <code>Provisioning Profiles</code>.</li>\n<li><strong>Mobile Patterns</strong>: Jailbreak/Root detection bypasses, hardcoded API keys in mobile source, or sensitive permission requests (Camera, GPS, Contacts) in non-mobile skills.</li>\n<li><strong>Risk</strong>: Malicious mobile package injection, credential theft from mobile builds, or device manipulation via ADB.</li>\n</ul>\n<h4>6. Information Disclosure &amp; Network Exfiltration</h4>\n<ul>\n<li><strong>Patterns</strong>: <code>curl</code>, <code>wget</code>, <code>Invoke-WebRequest</code>, <code>Invoke-RestMethod</code>, <code>scp</code>, <code>ftp</code>, <code>nc</code>, <code>socat</code>.</li>\n<li><strong>Sensible Data</strong>: <code>.env</code>, <code>.ssh</code>, <code>cookies.sqlite</code>, <code>Keychains</code> (macOS), <code>Credentials</code> (Windows), <code>keystore</code> (Android).</li>\n<li><strong>Intranet</strong>: Scanning internal IPs or mapping local services.</li>\n</ul>\n<h4>7. Service, Process &amp; Stability Manipulation</h4>\n<ul>\n<li><strong>Windows</strong>: <code>Stop-Service</code>, <code>taskkill /f</code>, <code>sc.exe delete</code>.</li>\n<li><strong>Unix/Mac</strong>: <code>kill -9</code>, <code>pkill</code>, <code>systemctl disable/stop</code>, <code>launchctl unload</code>.</li>\n<li><strong>Low-level</strong>: Direct disk access (<code>dd</code>), firmware/BIOS calls, kernel module management.</li>\n</ul>\n<h4>8. Obfuscation &amp; Persistence</h4>\n<ul>\n<li><strong>Encoding</strong>: <code>Base64</code>, <code>Hex</code>, <code>XOR</code> loops, <code>atob()</code>.</li>\n<li><strong>Persistence</strong>: <code>reg add</code> (Run keys), <code>schtasks</code>, <code>crontab</code>, <code>launchctl</code> (macOS), <code>systemd</code> units.</li>\n<li><strong>Remote script piping</strong>: network fetch commands that stream directly into a shell or PowerShell evaluator.</li>\n</ul>\n<h4>9. Legitimacy &amp; Scope (Universal)</h4>\n<ul>\n<li><strong>Registry Alignment</strong>: Cross-reference with <code>CATALOG.md</code>.</li>\n<li><strong>Structural Integrity</strong>: Does it follow the standard repo layout?</li>\n<li><strong>Healthy Scope</strong>: Does a \"UI Design\" skill need <code>adb shell</code> or <code>sudo</code>?</li>\n</ul>\n<h3>Step 3: Reporting</h3>\n<p>Generates a security report with a score (0-10), platform target identification, flagged actions, threat analysis, and mitigation recommendations.</p>\n<h2>Examples</h2>\n<h3>Example 1: Security Review</h3>\n<pre><code>\"Perform a security audit on this skill bundle\"\n</code></pre>\n<h3>Example 2: Cross-Platform Threat Analysis</h3>\n<pre><code>\"Scan for mobile threats in this AI skill\"\n</code></pre>\n<h2>Best Practices</h2>\n<ul>\n<li>✅ Perform non-intrusive analysis</li>\n<li>✅ Check for privilege escalation patterns</li>\n<li>✅ Look for information disclosure vulnerabilities</li>\n<li>✅ Analyze cross-platform threats</li>\n<li>❌ Don't execute potentially malicious code during audit</li>\n<li>❌ Don't modify the code being audited</li>\n<li>❌ Don't ignore mobile-specific security concerns</li>\n</ul>\n<h2>Common Pitfalls</h2>\n<ul>\n<li><p><strong>Problem:</strong> Executing code during audit\n<strong>Solution:</strong> Stick to static analysis methods only</p>\n</li>\n<li><p><strong>Problem:</strong> Missing cross-platform threats\n<strong>Solution:</strong> Check for platform-specific security issues on all supported platforms</p>\n</li>\n<li><p><strong>Problem:</strong> Failing to detect obfuscated payloads\n<strong>Solution:</strong> Look for encoding patterns like Base64, Hex, XOR loops, and atob()</p>\n</li>\n</ul>\n<h2>Related Skills</h2>\n<ul>\n<li><code>@security-scanner</code> - Additional security scanning capabilities</li>\n</ul>\n<h2>Limitations</h2>\n<ul>\n<li>Use this skill only when the task clearly matches the scope described above.</li>\n<li>Do not treat the output as a substitute for environment-specific validation, testing, or expert review.</li>\n<li>Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.</li>\n</ul>\n","files":[{"path":"SKILL.md","sizeBytes":6211,"isText":true}],"reviewScore":null,"reviewSummary":null,"trust":{"provenance":"human-reviewed","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow.","bodySource":null},"bodyLocked":false,"purchaseUrl":null,"sourceUrl":null,"report":{"provenance":"human-reviewed","screen":{"ran":true,"outcome":"flagged-cleared-by-moderator","suspicious":2,"notes":0,"hiddenCharacters":false},"virusScan":{"engine":"clamav","status":"clean","scannedAt":"2026-08-16T13:39:45.338037Z","sha256":"7759F0D385609FC9AC2D7CD8D7F5379F7AC92C2C7E39803459FBCAF1C83A1C50","sizeBytes":2843},"review":null,"source":{"repositoryUrl":"https://github.com/sickn33/agentic-awesome-skills","path":"skills/audit-skills","license":"MIT","commit":"f2bba339de74414b0771234cbe4f6a15258e32a3","subtreeSha":"2A30D46D89ED4E69555D1F01860F8677A48904F22A637E3848D799A5C7445153","lastSyncedAt":"2026-09-25T06:48:39.853703Z"},"reviewedAt":"2026-08-16T13:42:46.329108Z","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow."},"install":[{"target":"skills-cli","command":"npx skills add https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/audit-skills"},{"target":"claude-code","command":"claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install sickn33-agentic-awesome-skills@llmmart"},{"target":"git","command":"git clone https://github.com/sickn33/agentic-awesome-skills.git"}]}