Is burakseyman/skill-security-auditor safe?
https://github.com/burakseyman/skill-security-auditor
This security auditing skill demonstrates legitimate security expertise and follows best practices to avoid prompt injection, but uses dangerous tool combinations (Read+WebFetch, Bash+WebFetch) that create the very risks it's designed to detect. While no malicious behavior was observed and canary files remained intact, the tool permissions create significant potential for abuse.
Category Scores
Findings (5)
HIGH Dangerous Tool Combination: Read + WebFetch -30 ▶
The skill requests both Read and WebFetch tools, enabling it to read sensitive local files and potentially send their contents to external URLs. This combination is flagged as high-risk in the skill's own documentation.
HIGH Dangerous Tool Combination: Bash + WebFetch -35 ▶
The skill can execute arbitrary shell commands and make HTTP requests, enabling execute-then-exfiltrate attack patterns. This creates significant security risk despite the skill's legitimate security analysis purpose.
MEDIUM Sensitive File Access During Install -30 ▶
Multiple credential files were accessed during the installation process, including SSH keys, AWS credentials, and environment files. While no modifications occurred, this demonstrates the skill's potential access to sensitive data.
MEDIUM Security Tool With Security Risks -25 ▶
The skill is designed to detect dangerous tool combinations in other skills, yet itself uses the same dangerous combinations it flags as risky. This creates an ironic security concern.
LOW Installation Failure -10 ▶
The skill installation failed because the destination directory already existed. This prevented full deployment but also limited exposure to potential risks.