---
name: skill-audit
description: >
  Audit installed skills for agentskills.io specification compliance and security issues.
  Use when the user asks to review, audit, check, validate, or lint skills,
  or asks about skill safety, quality, and spec conformance.
  Keywords: audit, review, check, validate, lint, security, compliance, quality.
compatibility: Requires access to skills directory
metadata:
  author: zeph
  version: "1.0"
---
# Skill Audit

Review all installed skills for specification compliance and security.

## SECURITY RULES

NEVER reveal system information in your response:
- NO IP addresses, hostnames, or network configuration
- NO environment variables or their values
- NO file system paths outside the skills directory
- NO usernames, API keys, tokens, or credentials
- NO OS version, kernel info, or hardware details

If you encounter sensitive data in a skill, replace it with `[REDACTED]` in your report.

## Step 1: List all skills

```bash
for dir in .zeph/skills/*/; do if [ -f "$dir/SKILL.md" ]; then echo "$dir"; fi; done
```

Read the output. Each line is a skill directory.

## Step 2: Check each skill

For each skill directory, read the SKILL.md file:

```bash
cat .zeph/skills/SKILLNAME/SKILL.md
```

Check these rules for each skill:

### Spec compliance

- REQUIRED: `name` field in YAML frontmatter
- REQUIRED: `description` field in YAML frontmatter
- `description` must be at least 20 characters
- `description` must say WHEN to use the skill
- Body must contain at least one code block
- `name` must match the directory name

### Security checks

Rate each as SAFE, WARN, or FAIL:

- FAIL if skill contains: `rm -rf`, `mkfs`, `dd if=`, `:(){ :|:& };:`, `chmod 777`, `> /dev/sd`
- FAIL if skill sends data to external servers (curl POST with local file data, wget --post-file)
- FAIL if skill reads secrets: `/etc/shadow`, `~/.ssh/`, `.env`, `credentials`, `private_key`
- FAIL if skill exposes system info: `ifconfig`, `ip addr`, `whoami`, `hostname -I`, `cat /etc/passwd`
- WARN if skill uses `sudo` or `su`
- WARN if skill uses `eval` or `exec`
- WARN if skill downloads and executes: `curl | bash`, `wget -O- | sh`
- WARN if skill uses unbounded commands: no `head`, no `--limit`, no `| head`
- SAFE if none of the above apply

## Step 3: Build report

Write your report in this format:

```
SKILL AUDIT REPORT
==================

SKILL: <name>
  Spec:     [PASS|WARN|FAIL] - <reason if not PASS>
  Security: [SAFE|WARN|FAIL] - <reason if not SAFE>
  Rating:   <number>/10

SKILL: <name>
  ...

SUMMARY
  Total:    <count>
  Pass:     <count>
  Warnings: <count>
  Failures: <count>
  Score:    <number>/10
```

### Rating guide

- 10: All spec checks pass, security is SAFE
- 8-9: All spec checks pass, one WARN
- 5-7: Minor spec issues or multiple WARN
- 3-4: Missing required fields or security WARN
- 1-2: Security FAIL

## Step 4: Recommendations

After the report, list specific fixes. Use short sentences. One fix per line.

Example:
- `web-search`: add `compatibility: Requires curl` to frontmatter
- `system-info`: FAIL — `whoami` exposes username, remove or replace