Skill Security Reviewer — Security skill for Claude Code

skill-security-reviewer

[](https://github.com/juli-amezquita/skill-security-reviewer/actions/workflows/ci.yml) [](LICENSE)

Security review for third-party Claude skills and plugins, **before** you install them. Revisión de seguridad para skills y plugins de terceros de Claude, **antes** de instalarlos.

**[English](#english) · [Español](#español)**

---

English

The problem

A skill is mostly instructions that the model follows almost as if they were part of its own configuration, plus optional scripts that run with the agent's permissions. Installing one from a forum or a random repository is closer to running someone else's code than to reading a document.

The attack surface has also moved. A malicious skill no longer needs a script: it can ask the agent to use its own connectors, memory, scheduled tasks or browser. In Claude Code it can run shell commands at load time through `allowed-tools`, `hooks` or embedded commands, without a permission prompt.

How it works

Two layers, because each one catches what the other misses:

Layer	What it does	What it catches
Deterministic preflight (src/skill_preflight.py)	Inventories every file (hidden ones and symlinks included), hashes them, decodes invisible Unicode and flags load-time execution surfaces	What a reader misses: hidden directories, smuggled Unicode payloads, symlinks out of the package, binaries disguised as text, shebang-only scripts
Guided semantic review (SKILL.md)	Isolation rules, a 12-category threat catalog, severity rules and a report template that the agent follows	What a regex misses: intent, instructions aimed at the model or at the reviewer, abuse of the agent's own tools

Design decisions:

• Facts, not verdicts. The script never says "safe", and an empty report expli