skill-checker

A Claude Code plugin that security-audits installed skills and marketplace plugins for signs of user-data capture, secret/API-key exfiltration, prompt injection, and malicious code.

⚠️ Disclaimer: this is a best-effort review. It cannot guarantee that every instance of data capture, secret exfiltration, or malicious code will be found. A clean result means no known red flags were detected — not that a skill is safe. Only install skills and plugins from authors you trust.

What it does

Two layers:

1. Static scanner (skills/check-skills/scripts/scan.py, Python 3 stdlib only) walks skill/plugin directories and flags, with file:line references:
   • exfiltration patterns — curl | sh, env-vars piped to the network, webhook/tunnel endpoints (Discord/Slack/Telegram webhooks, ngrok, webhook.site, ...), download-then-execute
   • secret access — ~/.aws/credentials, SSH keys, keychain, .env, .npmrc, shell history, clipboard, browser cookie/login stores, Claude's own credentials and transcripts
   • prompt injection — "don't tell the user", "ignore previous instructions", concealment and override phrasing inside skill files
   • obfuscation — base64/hex blobs, decode-and-execute, dynamic eval/exec
   • destructive/persistence behavior — rm -rf ~, raw disk writes, fork bombs, crontab/LaunchAgents, shell-profile appends
   • structural risks — auto-run hooks, MCP server declarations, bundled compiled binaries, symlinks escaping the plugin directory
   • it also cross-flags any target that both reads secrets and sends data over the network, and lists every external domain referenced
2. Semantic review — the check-skills skill has Claude read the flagged files itself: purpose-vs-behavior mismatch, secret data flow, hook commands, MCP server definitions, decoded blobs. Scanned content is treated strictly as untrusted data; instructions found inside scanned skills are reported as findings, never followed.

Verdicts per skill/plugin: FAIL (any HIGH finding), REVIEW (any MEDIUM), PASS. Every run begins and ends with the disclaimer.

Install

Requirements

• Claude Code (CLI, desktop, or IDE extension) with plugin support
• Python 3.8+ on your PATH as python3 (the scanner uses only the standard library — no packages to install)

From GitHub (recommended)

Inside any Claude Code session:

/plugin marketplace add maludb-ed/skill-safety-checker
/plugin install skill-checker@skill-safety-checker

Restart Claude Code (or start a new session) and the check-skills skill is available everywhere.

From a local checkout

git clone https://github.com/maludb-ed/skill-safety-checker.git

Then, inside Claude Code:

/plugin marketplace add /path/to/skill-safety-checker
/plugin install skill-checker@skill-safety-checker

Verify it works

Ask Claude: "check my installed skills for security problems" — the first thing you should see is the security disclaimer, followed by a scan report. You can also run the scanner directly with no install at all:

python3 skills/check-skills/scripts/scan.py --list-targets

Update

/plugin marketplace update skill-safety-checker

Use

Ask in natural language, or invoke the skill directly:

• "Check my installed skills for security problems"
• "Is the foo plugin safe? Audit it before I use it"
• "Scan ~/.claude/plugins/marketplaces for anything malicious"

The scanner can also run standalone:

python3 skills/check-skills/scripts/scan.py            # standard locations
python3 skills/check-skills/scripts/scan.py PATH ...   # specific targets
python3 skills/check-skills/scripts/scan.py --json     # machine-readable

Default scan locations: ~/.claude/skills, ./.claude/skills, ~/.claude/plugins/cache (installed plugins), ~/.claude/plugins/marketplaces (marketplace clones). Nothing is hardcoded to a particular machine; paths resolve from $HOME and the current directory.

Limitations

• Runtime-downloaded payloads, compiled binaries, and remote MCP backends cannot be inspected ahead of time.
• Novel obfuscation or logic bombs may not match any pattern.
• A skill can change after you audit it — re-check after updates.
• MEDIUM/LOW findings are common in legitimate skills (e.g. a mail skill that uses its own API key); the point is to review them, not to panic.