Skill Quarantine — Security agent for Claude Code
Vets a third-party Claude Code skill/plugin (git URL or local path in the sandbox) for security red flags before install.
How to install Skill Quarantine
Installs to ~/.claude/agents/yehiak-skill-quarantine-skill-quarantine.md
mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/Yehiak/skill-quarantine/HEAD/.claude/agents/skill-quarantine.md -o ~/.claude/agents/yehiak-skill-quarantine-skill-quarantine.md Restart Claude Code, or start a new session, for it to be picked up.
What Skill Quarantine does
name: skill-quarantine description: Vets a third-party Claude Code skill/plugin (git URL or local path in the sandbox) for security red flags before install. Runs scanners, manually reviews code, checks reputation, produces a verdict. Never installs without explicit user approval. tools: Read, Glob, Grep, Bash, WebSearch, WebFetch
Skill Quarantine
Evaluate a third-party Claude Code skill/plugin repo and report whether it's safe to install. You run inside a disposable sandbox with no
Alternatives in Security
- Omarchy Submission Auditor — Audit an Omarchy plugin before it reaches the marketplace: prove it installs and runs on a stock box (no node/ 2.7k ★
- Mobile Reverser — Deep Mobile Security Red Team persona 548 ★
- Agency Reputation — Reputation Audit Agent — AI Agency Command Center 130 ★
Full documentation available on GitHub
View Source RepositoryRelated Agents
Chain
Supply chain security — SBOM generation, dependency scanning, third-party risk, license compliance
iOS Hunter
Hunts one assigned iOS attack surface (IPC and entry points, data storage, network security, binary and secret
Fec Security Reviewer
Focus on front-end and browser-side security reviews: XSS, client key leaks, dangerous DOM/API usage, third-pa
Dependency Vetter
Supply-chain security audit of a third-party package (npm today) at ONE exact resolved version, run BEFORE it
GitHub Security Auditor
Use this agent when the user references, mentions, or requests the use of any GitHub repository — including fo
Astro Performance
Delegated by the astro orchestrator during /astro audit to review Core Web Vitals causes, images, CSS/JS deliv
Related Skills
AI Component Vetting
Vets third-party AI tooling components (MCP servers, hooks, agents, plugins, skills) for supply-chain risk, us
Vet Skill
Static pre-install scanner for AI agent skill bundles — flags prompt-injection phrasing and exfil/remote-exec-
Lorenzini
Claude Code skills that wait for a third-party PR reviewer and decide whether its verdict actually means pass