Audit third-party AI skills and MCP servers before install

Skill Security Audit provides a structured, read-only workflow to review third-party Agent Skills, MCP servers, connectors, plugins, and desktop extensions before installation. It inventories capabilities, traces sensitive data flows, inspects dependencies and provenance, and produces an evidence-based risk assessment without executing code or connecting real credentials.

Use this skill before installing an unfamiliar Skill, MCP server, connector, plugin, or desktop extension. Use it when a project handles files, credentials, browser sessions, external accounts, network requests, or destructive actions. Use it when a release, binary, dependency, or remote installer cannot be independently verified.

Do not use this skill as a runtime behavior proof or safety certificate. Static review cannot verify the contents of opaque remote services or guarantee production behavior. Stop if the requested review would require real credentials, production data, or an unapproved external action.

You provide the exact repository, revision or release, and scope of the project to audit. The skill reads the complete SKILL.md or equivalent instructions and every file it directly invokes.

You receive a report beginning with one verdict: Lower observed risk (no material concern found in reviewed scope), Review required (important behavior, provenance, permissions, or data flow remains unclear), or High observed risk (confirmed behavior could expose sensitive data, weaken security, cause irreversible action, or bypass informed control). The report includes scope and limitations, a capability and permission table, a data-flow table, findings ordered by severity with evidence and mitigation, unanswered questions, and a minimal-permission test plan.

The workflow records the exact repository, revision or release, license, archive status, latest meaningful update, and files reviewed, stating any scope limitation. It inventories capabilities including filesystem access, command execution, network access, browser control, account actions, publishing, messaging, deletion, payment, credential access, persistence, and self-update behavior. It traces sensitive data from source to local stores, subprocesses, logs, models, APIs, MCP servers, analytics services, and other network destinations. Missing documentation is treated as an unresolved question, not proof that data stays local. The skill inspects dependency manifests, lockfiles, install scripts, and release provenance, noting unpinned remote execution, broad dependencies, opaque binaries, and mismatches between source and distributed artifacts. Findings are separated from contextual risks and unanswered questions, with file paths, line numbers, configuration fields, commands, or primary documentation cited for every material claim. A minimal-permission test using disposable data or accounts is proposed but not run without explicit user approval.

This skill is for developers, security engineers, and teams evaluating third-party integrations before deployment. It serves anyone who needs evidence-led risk assessment of Agent Skills, MCP servers, connectors, or extensions that request filesystem, network, credential, or account permissions. The workflow prioritizes implementation and current primary documentation over badges, screenshots, descriptions, or popularity, and uses disposable data, least privilege, localhost binding, dry runs, backups, confirmation gates, and rollback where applicable.