Scan reports · sickn33/agentic-awesome-skills
007: scan report
Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project. An automated scan of this public skill from sickn33/agentic-awesome-skills: security, token cost, spec and clarity, with every finding and its fix.
Result
Verdict
50/100 · grade F
sickn33/agentic-awesome-skills/plugins/agentic-awesome-skills-claude/skills/007 at c564f9f
Spec 21 · Efficiency 9 · Clarity 20 · Security 0 (each out of 25)
Always loaded 42 tokens · on trigger 307 · on demand 79,132
sec/hidden-commentwarn · references/ai-agent-security.mdHTML comment carries instructions the user won't see rendered.sec/hidden-commentwarn · references/detailed-guide.mdHTML comment carries instructions the user won't see rendered.sec/secret-readwarn · scripts/scanners/dependency_scanner.py:166Touches credential files.eff/description-triggerwarn · SKILL.mddescription doesn't say *when* to use the skill ("Use when …"). Agents decide from this line alone.sec/prompt-injectionwarn · references/ai-agent-security.md:18Tries to override the agent's instructions. Reads as an example or a warning here; check it in context.sec/prompt-injectionwarn · references/ai-agent-security.md:18Role-hijack phrasing. Reads as an example or a warning here; check it in context.sec/prompt-injectionwarn · references/owasp-checklists.md:46Tries to override the agent's instructions. Reads as an example or a warning here; check it in context.sec/remote-execwarn · scripts/scanners/dependency_scanner.py:792Downloads and executes remote code. Reads as an example or a warning here; check it in context.sec/obfuscationwarn · scripts/scanners/injection_scanner.py:155Decodes or evaluates hidden code. Reads as an example or a warning here; check it in context.clarity/exampleswarn · SKILL.mdNo examples or code blocks. One concrete input → output example improves consistency more than extra rules.sec/undocumented-scriptwarn · SKILL.mdBundles scripts that SKILL.md never explains. Say what each script does and when it runs.spec/non-portable-keyswarn · SKILL.mdNon-spec frontmatter (risk, source, date_added, author, tags, tools). claude.ai and the Skills API reject the upload; move them under `metadata` or drop them.eff/orphan-fileinfo · references/ai-agent-security.mdreferences/ai-agent-security.md is never mentioned in SKILL.md, so the agent won't know to read it.eff/orphan-fileinfo · references/api-security-patterns.mdreferences/api-security-patterns.md is never mentioned in SKILL.md, so the agent won't know to read it.eff/orphan-fileinfo · references/incident-playbooks.mdreferences/incident-playbooks.md is never mentioned in SKILL.md, so the agent won't know to read it.eff/orphan-fileinfo · references/owasp-checklists.mdreferences/owasp-checklists.md is never mentioned in SKILL.md, so the agent won't know to read it.eff/orphan-fileinfo · references/stride-pasta-guide.mdreferences/stride-pasta-guide.md is never mentioned in SKILL.md, so the agent won't know to read it.sec/plain-httpinfo · SKILL.mdLinks over plain http.
Where it comes from
Source
| Fact | Value |
|---|---|
| Repository | sickn33/agentic-awesome-skills |
| Skill folder | plugins/agentic-awesome-skills-claude/skills/007 |
| Stars | 47,723 |
| License | MIT |
| Commit scanned | c564f9f |
| Scanned | 2026-10-16 |
| Files | 16 |
ProSkills doesn't host or redistribute this skill. Get it from its repository, and check the license before reusing it. Something wrong here? Open an issue for a rescan or removal.
For maintainers
Badge for the README
If you maintain this skill, this badge shows its score and links to this report. Fix findings and the score moves with the next scan.
[](https://proskills.dev/reports/sickn33-007)
Alternatives
Scanned alternatives on ProSkills
Skills in the ProSkills catalog that cover similar ground. Every one passes the same scanner before it ships.
- Security ReviewExploit sketch, severity and fix for each finding.Loads when the change touches auth, user input, outbound requests, secrets or an LLM feature.5 rules · Code ReviewScan 100$12
- K8s Manifest ReviewProbes, limits and security contexts done right.Loads when the user writes or reviews Kubernetes manifests, Helm or Kustomize.5 rules · DevOps & CloudScan 100$9
Same repository
More from sickn33/agentic-awesome-skills
- 00-andruia-consultantGrade A90/100
- 10-andruia-skill-smithGrade B86/100
- 20-andruia-niche-intelligenceGrade B86/100
- 2slides-ppt-generatorGrade B80/100
- 360-feedback-systemGrade A91/100
- 3d-web-experienceGrade A96/100
- aas-compose-stackGrade A90/100
- aas-discoverGrade B84/100
- aas-review-stackGrade A90/100
- ab-test-setupGrade A96/100
- ab-testingGrade B84/100
- acceptance-orchestratorGrade A96/100
FAQ
Questions
- Is 007 safe to install?
- No critical findings, some security notes. The scan covers prompt injection, hidden Unicode, remote code execution and credential access in every text file of the skill. It cannot judge intent, so read any flagged line in context before installing.
- How was this score calculated?
- Four checks of 25 points each: spec, efficiency, clarity and security. Findings take points off the check they belong to, and any critical finding caps the grade at F. The same scanner runs in your browser at proskills.dev/scan.
- Is this report current?
- It was made from commit c564f9f on 2026-10-16. If the skill has changed since, paste the new version into the scanner for a fresh score.
- I wrote this skill. Can I fix the score or have the page removed?
- Fix the findings and push. The reports are rebuilt from GitHub on a schedule, so the next run picks the change up. To have the page removed, open an issue on the ProSkills GitHub repo.
Related
Keep reading
Free tool
Scan your own skill
Paste a SKILL.md or drop a folder. It is scored in your browser and nothing is uploaded.
Want a skill that already passes? Start with a free one.