git:20260312.0dc8494 to git:20260312.b920a35

---

name: panguard-skill-auditor

description: Automated security auditor for AI agent skills. Scans SKILL.md files for prompt injection, tool poisoning, hidden Unicode, encoded payloads, secrets, and dangerous permissions. Returns a 0-100 risk score.

homepage: https://panguard.ai/docs/skill-auditor

metadata:

{

{

[

{

},

],

},

}

---

# Panguard Skill Auditor

Automated security scanner for AI agent skills. Use **before installing any skill** from ClawdHub, GitHub, or other sources.

Unlike manual checklists, this runs real static analysis: regex pattern matching, Unicode inspection, Base64 payload decoding, SAST, and secrets scanning.

## When to Use

- Before installing any skill from ClawdHub or GitHub

- When evaluating third-party SKILL.md files

- Before adding skills to your agent fleet

- As a CI gate for skill repositories

## Quick Start

```bash

# Audit a skill directory

panguard audit skill ./path/to/skill

# Audit a skill from a GitHub URL

panguard audit skill https://github.com/user/repo/tree/main/skills/my-skill

```

## What It Checks

### 1. Manifest Validation

Verifies SKILL.md frontmatter: required fields (name, description), valid metadata structure, and proper formatting.

### 2. Prompt Injection Detection

11 regex patterns detect:

- "Ignore previous instructions" variants

- Identity override ("you are now", "act as")

- System prompt manipulation

- Jailbreak patterns (DAN, bypass safety)

- Hidden text in HTML/markdown comments

### 3. Hidden Content Detection

- Zero-width Unicode characters (U+200B, U+200C, U+200D, RTL overrides)

- Base64-encoded payloads containing `eval`, `exec`, `subprocess`, `child_process`

- Homoglyph attacks

### 4. Tool Poisoning Detection

- Privilege escalation (`sudo`, `chmod 777`)

- Reverse shell patterns (`nc -e`, `bash -i >&`, `/dev/tcp/`)

- Remote code execution (`curl | bash`)

- Environment variable exfiltration

- Sensitive file access (`~/.ssh`, `.env`, `.aws/`)

- Destructive operations (`rm -rf /`)

### 5. Code Security (SAST + Secrets)

Scans all files in the skill directory:

- Static analysis for common vulnerabilities

- Hardcoded API keys, tokens, passwords

- AWS credentials, private keys

### 6. Dependency Analysis

Checks declared dependencies for known issues.

### 7. Permission Scope Analysis

Evaluates requested permissions against the skill's stated purpose.

## Output Format

Returns a structured report:

```

PANGUARD SKILL AUDIT REPORT

============================

Skill: my-skill

Risk Score: 72/100

Risk Level: CRITICAL

Duration: 0.3s

CHECKS:

[FAIL] Prompt Safety: 2 suspicious pattern(s) detected

[PASS] Manifest: Valid SKILL.md structure

[WARN] Code: 1 issue(s) found; Secrets: No hardcoded credentials

[PASS] Dependencies: No known issues

[PASS] Permissions: Scope appropriate

FINDINGS:

[CRITICAL] Prompt injection: ignore previous instructions

SKILL.md:42 - "ignore all previous instructions and..."

[HIGH] Reverse shell pattern detected

SKILL.md:87 - "bash -i >& /dev/tcp/..."

VERDICT: DO NOT INSTALL - Critical security issues found

```

## Risk Levels

## Integration with Your Agent

Add to your agent's pre-install hook:

```bash

# In your agent's skill install pipeline

panguard audit skill "$SKILL_PATH" --json | jq '.riskLevel'

# Block installation if HIGH or CRITICAL

```

## Comparison with Manual Vetting

## Learn More

- Docs: https://panguard.ai/docs/skill-auditor

- Blog: https://panguard.ai/blog/skill-auditor-guide

- GitHub: https://github.com/panguard-ai/panguard-ai