skill-vetter-pro：面向 Agent Skill 的五维安全审查
skill-vetter-pro（@user_80e2caa5/skill-vetter-pro，v1.0.0）是 SkillHub 社区 it-ops-security 类 Skill，对目标 Skill 做静态分析、Shell 扫描、SHA256 哈希链完整性校验、OSV 依赖 CVE 审计及 strace 行为监控，输出可安装、谨慎或拒绝裁决。本文基于官方页面说明五维能力、SkillHub CLI 与提示词安装方式、触发词用法及行为执行等注意事项，便于装包前结构化体检。
Read Moreskill-scanner：安装前本地静态扫描 Agent Skill 安全风险
skill-scanner 是 SkillHub 社区 Skill（@user_87fe1a85/gwchen17，v1.0.0），由腾讯朱雀 Lab A.I.G（AI-Infra-Guard）支撑，在安装或使用任意 Agent Skill 前做 100% 本地静态安全分析，文件与凭据不外传。无需 API Key，兼容 Cursor、Claude Code、Windsurf、OpenClaw 等。文章说明核心能力、skillhub CLI 安装路径与对话触发语，并区分其与日常开发调试类请求的边界。
Read MoreStatic Analysis: Chaining CodeQL, Semgrep, and SARIF into a Reusable SAST Workflow
The static-analysis plugin in the Trail of Bits skills marketplace combines deep CodeQL analysis, Semgrep rule-set scanning, and SARIF parsing into reusable Agent workflows. It includes three skills—codeql, semgrep, and sarif-parsing—along with the run-scans.sh and merge_sarif.py scripts and the /static-analysis:semgrep-scan and /static-analysis:codeql-build workflows. The article covers installation commands, typical invocation patterns, approval gates, differences from read-only scanning, and practical constraints such as ensuring database build quality and disabling metrics, to help systematically implement SAST in AI-assisted security audits.
Read MoreTesting Handbook Skills: Turning the Testing Handbook into an Executable AppSec Testing Workflow
testing-handbook-skills is a Code Auditing plugin in the Trail of Bits skills marketplace that structures the Testing Handbook on appsec.guide into a Skill usable by Claude Code or Codex. It includes the testing-handbook-generator meta-skill, 14 generated fuzzer, technology, and domain topics, and validation support via validate-skills.py. The article explains its positioning, generation workflow, installation commands for Claude Code and Codex, typical generation prompts, usage of uv-based validation, and considerations such as manual resolution of handbook paths, the absence of generated cross-references, and the need to provide the required tool environment yourself.
Read Moredsh-plugin-guard: A Security Check Tool for DeepSeek Harness Plugins
dsh-plugin-guard is an offline static security scanning plugin designed specifically for DeepSeek Harness (DSH). It aims to address the risks associated with introducing third-party plugins by using static analysis to detect high-risk signals such as prompt injection, file corruption, credential leakage, supply chain poisoning, and Unicode spoofing. By default, the tool operates in read-only mode without code execution, and supports scanning via Harness commands or independent command-line execution. Developers should note that static scanning can only detect known risks and cannot replace sandboxing or manual review, while the exit code only indicates the risk level.
Read MoreSemgrep-Rule-Creator: Using Agent to Write Testable Semgrep Security Rules
`semgrep-rule-creator` is an Agent Skill launched by Trail of Bits, used to create custom Semgrep rules that can detect security vulnerabilities, bug patterns and code patterns. Instead of running existing rule sets, it forces the Agent to produce rules following the workflow of test-first, AST analysis, priority given to taint mode, and optimization only after all tests pass. This article organizes the installation method, seven-step workflow, eval taint example and usage boundaries based on the official SKILL.md, plugin README and skill market description.
Read More