Check a skill's published security audits
A small Codex skill that finds a third-party skill on Vercel's skills.sh, opens the three primary audit reports, and preserves missing, stale, or conflicting evidence instead of flattening it into a false “safe” result.
CHECK
One lookup, three audit trails
The skill reads the canonical listing and the detailed child pages for Gen Agent Trust Hub, Socket, and Snyk. It captures the verdict, risk level, findings, affected paths, and audit time from each provider—not only the badges on the listing page.
Gen Agent Trust Hub reviews agent behavior and instruction risks. Socket focuses on supply-chain signals. Snyk reports security issues and risk categories. Disagreement is useful evidence and remains visible in the final report.
INPUT
Start with any useful identifier
Direct skills.sh URL
- Accepts a listing or nested security-audit URL.
- Normalizes it to owner, repository, and skill slug.
- Fetches the listing plus all three detail pages concurrently.
New or unlisted skill
- Uses a GitHub URL, local Git remote, or exact skill name.
- Searches for an exact publisher, repository, and slug match.
- Returns not found, pending, partial, or ambiguous—not “pass.”
The workflow never installs an untrusted skill merely to trigger a registry audit. Installation remains a separate, explicitly authorized decision.
READ
Keep uncertainty visible
- Resolve identityRecord the canonical skills.sh ID and the exact artifact or commit under review.
- Collect detailsRead every provider page and retain findings, timestamps, and missing coverage.
- Check freshnessFlag audit dates that predate the target change or cannot be tied to its snapshot.
- Reconcile locallyCompare registry evidence with SkillSpector and manual review of the exact artifact.
A fail, high, or critical result blocks use pending review. A warning requires manual inspection. Missing or stale evidence is incomplete coverage. Even three passes do not prove runtime safety.
USE
Download, inspect, and run
vercel-skills-sh-security-check/
├── SKILL.md
├── agents/
│ └── openai.yaml
└── scripts/
└── check_skills_sh_security.py- Guide
- Identity resolution, collection rules, interpretation, and safety boundaries.
- Helper
- Standard-library Python that fetches the listing and three audit pages concurrently.
python3 scripts/check_skills_sh_security.py https://skills.sh/graphify-labs/graphify/graphifypython3 scripts/check_skills_sh_security.py https://github.com/graphify-labs/graphify --skill graphifyTake the complete skill
Download the ZIP for installation, or inspect each source file in the browser before adding it to an agent.
LIMITS
Registry evidence is a lead, not a certificate
The result reflects third-party audits of a skills.sh snapshot. It does not verify publisher identity, prove that the downloaded files match that snapshot, resolve future dependencies, or test runtime behavior. Use it in parallel with an exact-artifact scan and human review.