## https://sploitus.com/exploit?id=53BF54EE-D6A6-593A-9B59-01D256FCF52F
# AI Security Skill Scanner
A meta-tool for performing security risk scans on the NSEAP Skill directory.
## Quick Start
```bash
# Installation
cd skill-scanner
python -m venv venv
venv/Scripts/activate
pip install -e . # Scan one skill
skill-scanner -i path/to/skill/ -o report.md
```
## Project Structure
```bash
skill-scanner/
│ ├── src/
│ │ ├── parser/ # Skill parser
│ │ ├── rules/ # Risk rules (R1-R6)
│ │ ├── reporters/ # Report generator
│ │ ├── engine.py # Rule engine
│ │ └── cli.py # Command-line interface
│ ├── tests/ # Unit tests
│ ├── examples/ # Example skills for testing
│ ├── reports/ # Output directory for scan reports
│ └── docs/ # Design documents & weekly reports
```
## Risk Rules
| Rule ID | Category | ECS Rating |
|--------|----------|-------------|
| R1 | Credentials/Key leaks | L4-L5 |
| R2 | Command injection risks | L3-L5 |
| R3 | File system privilege escalation | L3-L4 |
| R4 | Network request risks | L3-L4 |
| R5 | Permission escalation risks | L4-L5 |
| R6 | Data leakage risks | L3-L5 |
## Example Report
The scan results include:
- Verdict: PASS (no risk)/BLOCK (high risk)
- Each detected ECS rating, trigger location, and recommended fixes
- JSON format (for program consumption) + Markdown format (for human reading)