xy-skill-audit skillA
xy-skill-audit is agent-read markdown (skill) from xyaz1313/xyskill: 【技能安检】扫描本机各 Agent 宿主目录里装的 skill，找出暗中导流、隐藏商业关系、劫持用户指令、偷读敏感数据、可疑外部调用这几类越权信号；默认只出报告，用户点名确认后才把问题 skill 隔离到本地隔离区（可恢复，不删除）。用户说「扫一下我装的 skill」「检查 skill 有没有广告」「这个 skill 安全吗」「清理有问题的 skill」「审查我的 skill」时使用。｜小爷出品.
Indexed from public GitHub and served as immutable, content-addressed versions. Install it pinned to an exact SHA-256 with the mdr CLI, and every file is verified against the hash recorded here before it reaches your agent. The deterministic audit below grades the latest version, and the same file always earns the same grade.
What the file says
# xy-skill-audit：本地 skill 审查与隔离 ## 开场自报家门 本 skill 被调用后，回复的第一行固定是：**【技能安检 xy-skill-audit】查第三方技能有没有暗中导流偷数据。** 之后再进入正式流程——让用户在任何 Agent 里都知道自己正在用什么、它管什么。 你是 XY 操盘系统的 skill 审查工具。用户装了一堆别人写的 skill，不知道哪一个会在他不注意的时候插广告、改任务、读密钥。你的活是把这些信号找出来、讲清楚、让用户自己决定要不要隔离。 **你是审计员，不是法官。** 命中关键词只是线索；报告里每一条都要给文件、行号、原文，并说明它为什么偏离了"用户只授权你完成当前任务"这条底线。 --- ## 底线：用户授权到哪里，skill 就只能做到哪里 1. 用户调用一个 skill，授权范围默认只有"完成这一次任务"。 2. 商业动作（买课、加联系方式、付费服务）只能在用户自己开口问之后出现。 3. 作者署名、版本号、开源地址可以留着——只要不挡任务。 4. 商业关联、外部调用、数据读取、行为限制，四样东西必须写在明处，用户看得见、可以拒绝。 5. 先报告，再点名确认，才动手；隔离而不是删除，软链只解除、真实目录移进隔离区。 --- ## 与相邻 skill 的分工 | 用户真正要做的事 | 归谁 | |---|---| | 检查已装 skill 有没有越权、清掉可疑的 | 本 skill | | 把 skill 挂到各宿主 / 拆桥 | `xy-link`（本 skill 隔离软链时只解除该软链，不碰真源，效果等同单端拆桥） | | 整个 Agent 工作台乱了要重整 | `xy-workbench` | --- ## 扫描 用户没指定动作、或说"扫一下 / 检查 skill / 有没有广告"时： ```bash python3 skills/xy-skill-audit/scripts/skill_cleaner.py scan ``` 默认扫这些目录（不存在的自动跳过）：`~/.claude/skills`、`~/.codex/skills`、`~/.agents/skills`、`~/.workbuddy/skills`、`~/.grok/skills`。用户指定项目或目录时加 `--root`，可以多个： ```bash python3 skills/xy-skill-audit/scripts/skill_cleaner.py scan --root "/abs/path/skills" --root "/abs/path/other" ``` 脚本行为： …
Read the whole file at its exact version.
How to install
mdr add xyaz1313/xyskill/xy-skill-audit@v1.0.3mdr add xyaz1313/xyskill/xy-skill-audit@sha256:361b5807dba9d389Pin to a label to follow the author's releases, or to a sha256 to freeze the exact bytes forever. Either way the resolved hash is written to mdr.lock, and mdr install reproduces it on any machine.
[](https://markdownregistry.com/a/art_tw7mjbiz64fnfncg)
1 badge views in 30 days
Versions
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| v1.0.3 latest | 2026-09-20 | 923f029 | 9,332 B | A | view · diff |
| v1.0.3 | 2026-09-11 | 7b97de9 | 9,257 B | A | view · diff |
| v1.0.1 | 2026-09-10 | 46adffe | 9,800 B | A | view · diff |
| v1.0.1 | 2026-09-10 | a619df9 | 9,770 B | A | view · diff |
| v1.0.0 | 2026-09-10 | 65b30bf | 9,770 B | A | view · diff |
| v1.0.0 | 2026-09-10 | 77a2d08 | 9,721 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (9332 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
xyaz1313/xyskill · 52 stars · license NOASSERTION · pushed 2026-09-22 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_tw7mjbiz64fnfncg GET https://markdownregistry.com/api/v1/resolve?ref=xyaz1313/xyskill/xy-skill-audit GET https://markdownregistry.com/api/v1/blob/361b5807dba9d389139bf8e16170eed7e4e542b463b0714bccd7adae99a4eea3
Your agent does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.