Agent Security Super Skill — Security skill for Claude Code

Agent Security Super-Skill

A comprehensive defensive security playbook for AI agents — covering prompt injection defense, skill/plugin validation, memory poisoning prevention, permission auditing, tool-use safety, data exfiltration prevention, and incident response.

---

Before You Install This (Or Any) Skill — Verify It First

A security skill that asks you to blindly trust it would be ironic. So don't. Here's how to verify this skill — and any other SKILL.md file you find online — before installing it.

Step 1: Read the raw file yourself

SKILL.md files are plain-text markdown. There's no compiled code, no binaries, no hidden executables. Open the file in any text editor and read it. You're looking for:

• No embedded scripts or shell commands that run automatically. A SKILL.md is instructions for an AI agent, not executable code. If you see curl | bash, eval(), exec(), or anything that phones home to an external URL as part of an auto-run step — that's a red flag.
• No obfuscated content. Base64 blobs, hex-encoded strings, or minified code blocks that you can't read have no business in a skill file. Every line should be human-readable.
• No requests for credentials. A skill should never ask the agent to collect, store, or transmit API keys, passwords, tokens, or personal data to external endpoints.
• No allowed-tools granting broad permissions. Check the YAML frontmatter. If a skill pre-approves dangerous tools (shell access, file deletion, network requests) without explanation — don't install it.

Step 2: Verify the source

# Check the repo owner, commit history, and stars
# A single anonymous commit with no history is a yellow flag
gh repo view get-zeked/agent-security-super-skill
git log --oneline

Ask yourself:

• Does the repo have a real owner with other public repos?
• Is there meaningful commit history (not just one anonymous dump)?
• Are there stars, forks, or issues from other users?
• Does the README match