Is addyosmani/agent-skills safe?
https://github.com/addyosmani/agent-skills
addyosmani/agent-skills is a collection of 24 engineering workflow skill documents authored by Addy Osmani (Google Chrome DevRel) designed to improve AI agent code quality. No prompt injection, data exfiltration, malicious code execution, or canary compromise was detected. Pre-clone accesses of honeypot files are attributable to the oathe monitoring framework's own baseline scan, not the skill. The only notable concern is the doubt-driven-development skill's instructions for invoking external AI CLIs (Gemini, Codex), which includes appropriate safeguards but expands agent attack surface. The skills are actively security-positive, teaching agents SSRF prevention, injection defense, and social engineering resistance.
Category Scores
Findings (6)
LOW Shell Scripts Present in Repository -7 ▶
The repository includes several shell scripts in hooks/ and skills/idea-refine/scripts/ directories. These are Claude Code workflow hooks and development utilities. While legitimate in purpose, they represent executable code that will be installed alongside the skill content. The hooks (session-start.sh, sdd-cache-pre.sh, sdd-cache-post.sh, simplify-ignore.sh) are designed for Claude Code's hook system and are not auto-executed on install.
LOW External AI CLI Invocation Instructions in doubt-driven-development -8 ▶
The doubt-driven-development skill contains detailed instructions for invoking external AI CLIs (Gemini CLI, Codex CLI) for cross-model adversarial review. The skill includes safety guidance (read-only sandboxes, stdin piping, per-invocation user authorization), but this feature expands the agent's attack surface and could be misused if safeguards are not properly enforced by the host platform.
INFO Source-Driven-Development Instructs URL Fetching -5 ▶
The source-driven-development skill explicitly instructs the agent to fetch external URLs (official documentation sites) before implementing framework-specific code. This is intentional and beneficial behavior, but it means agents following this skill will make external network requests. The skill limits fetching to official documentation sources and explicitly prohibits Stack Overflow and blog posts.
INFO Pre-Clone Canary File Accesses Attributed to Audit Framework 0 ▶
inotify monitoring shows /home/oc-exec/.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and gcloud credentials were opened at 17:21:42 (audit epoch 1785950502). The git clone did not occur until 17:21:48 (epoch 1785950508). Auditd PATH records attribute these accesses to audit sequences 261-268, consistent with the oathe monitoring framework's own baseline canary check. Canary integrity report confirms all files intact with no exfiltration. This is NOT attributable to the skill.
INFO Normal Git Clone Network Activity -5 ▶
The only external network connection during and after clone was to GitHub (140.82.121.4:443) for the standard HTTPS git clone operation. DNS queries resolved github.com. No unexpected connections to third-party data collection or command-and-control endpoints were observed. Connection state before and after clone shows no new persistent listeners.
INFO Security-Positive Skill Design -10 ▶
The skill collection demonstrates security awareness throughout. The security-and-hardening skill teaches SSRF prevention, LLM output sanitization, and injection defenses. The browser-testing skill explicitly warns against treating browser content as agent instructions. Eval fixtures include authority-pressure and time-pressure scenarios testing agent resistance to social engineering. The using-agent-skills meta-skill explicitly lists failure modes including sycophancy and scope creep.