panguard-skill-auditor
Automated security auditor for AI agent skills. Scans SKILL.md files for prompt injection, tool poisoning, hidden Unicode, encoded payloads, secrets, and dangerous permissions. Returns a 0-100 risk score.
Panguard Skill Auditor
Automated security scanner for AI agent skills. Use before installing any skill from ClawdHub, GitHub, or other sources.
Unlike manual checklists, this runs real static analysis: regex pattern matching, Unicode inspection, Base64 payload decoding, SAST, and secrets scanning.
When to Use
- Before installing any skill from ClawdHub or GitHub
- When evaluating third-party SKILL.md files
- Before adding skills to your agent fleet
- As a CI gate for skill repositories
Quick Start
# Audit a skill directory
panguard audit skill ./path/to/skill
# Audit a skill from a GitHub URL
panguard audit skill https://github.com/user/repo/tree/main/skills/my-skill
What It Checks
1. Manifest Validation
Verifies SKILL.md frontmatter: required fields (name, description), valid metadata structure, and proper formatting.
2. Prompt Injection Detection
11 regex patterns detect:
- "Ignore previous instructions" variants
- Identity override ("you are now", "act as")
- System prompt manipulation
- Jailbreak patterns (DAN, bypass safety)
- Hidden text in HTML/markdown comments
3. Hidden Content Detection
- Zero-width Unicode characters (U+200B, U+200C, U+200D, RTL overrides)
- Base64-encoded payloads containing
eval,exec,subprocess,child_process - Homoglyph attacks
4. Tool Poisoning Detection
- Privilege escalation (
sudo,chmod 777) - Reverse shell patterns (
nc -e,bash -i >&,/dev/tcp/) - Remote code execution (
curl | bash) - Environment variable exfiltration
- Sensitive file access (
~/.ssh,.env,.aws/) - Destructive operations (
rm -rf /)
5. Code Security (SAST + Secrets)
Scans all files in the skill directory:
- Static analysis for common vulnerabilities
- Hardcoded API keys, tokens, passwords
- AWS credentials, private keys
6. Dependency Analysis
Checks declared dependencies for known issues.
7. Permission Scope Analysis
Evaluates requested permissions against the skill's stated purpose.
Output Format
Returns a structured report:
PANGUARD SKILL AUDIT REPORT
============================
Skill: my-skill
Risk Score: 72/100
Risk Level: CRITICAL
Duration: 0.3s
CHECKS:
[FAIL] Prompt Safety: 2 suspicious pattern(s) detected
[PASS] Manifest: Valid SKILL.md structure
[WARN] Code: 1 issue(s) found; Secrets: No hardcoded credentials
[PASS] Dependencies: No known issues
[PASS] Permissions: Scope appropriate
FINDINGS:
[CRITICAL] Prompt injection: ignore previous instructions
SKILL.md:42 - "ignore all previous instructions and..."
[HIGH] Reverse shell pattern detected
SKILL.md:87 - "bash -i >& /dev/tcp/..."
VERDICT: DO NOT INSTALL - Critical security issues found
Risk Levels
| Score | Level | Action |
|---|---|---|
| 0-14 | LOW | Safe to install after quick review |
| 15-39 | MEDIUM | Review findings before installing |
| 40-69 | HIGH | Requires thorough manual review |
| 70-100 | CRITICAL | Do NOT install |
Integration with Your Agent
Add to your agent's pre-install hook:
# In your agent's skill install pipeline
panguard audit skill "$SKILL_PATH" --json | jq '.riskLevel'
# Block installation if HIGH or CRITICAL
Comparison with Manual Vetting
| Feature | Manual Checklist | Panguard Auditor |
|---|---|---|
| Speed | Minutes per skill | < 1 second |
| Consistency | Varies by reviewer | Deterministic |
| Hidden Unicode | Easy to miss | Automatic detection |
| Base64 payloads | Requires manual decode | Auto-decode + analyze |
| Code SAST | Not included | Integrated scanner |
| Secrets scan | Manual grep | Pattern-based detection |
| Risk score | Subjective | Quantitative (0-100) |