Screen every SKILL.md
before it reaches your agent.
A human-performed security audit for your agent skill files. We apply a 15-point checklist and 47 detection rules to every file, then deliver a signed PDF report with line-level findings and remediation priorities. $250, 48-hour turnaround.
Eight classes of threat, inside every file.
Prompt injection
Hidden instructions trying to override the host agent's system prompt, role, or safety rules. In plain prose, in comments, in image alt text.
Data exfiltration
Outbound requests that ship environment variables, file contents, or tool output to an attacker-controlled endpoint under the guise of "logging".
Destructive shell
Recursive deletes, privilege escalation, package installs, or long-running background processes disguised as routine maintenance steps.
Tool-call misuse
Skills that invoke tools outside their declared scope, bypass approval flows, or chain calls to escalate capability beyond what the user authorized.
Credential handling
Hardcoded keys, broad token scopes, requests to read secrets from unexpected paths, or instructions that tell the agent to paste secrets inline.
Hidden instructions
Zero-width characters, white-on-white text, HTML comments, and base64-encoded payloads that the model reads but a human reviewer does not.
Supply-chain drift
Skills that silently changed behavior between versions, or whose dependencies (scripts, fetched URLs, pinned models) shift under the same hash.
Model confusion
Ambiguous role blocks, fake tool signatures, and counterfeit "system" messages engineered to make the agent misread who is speaking.
From your files to signed report in four steps.
Book
Fill in the form below with your email. We confirm your booking and send payment details within one business day.
Upload
We email you a secure upload link for your skill files: SKILL.md, CLAUDE.md, AGENTS.md, .cursorrules, and copilot-instructions.md.
Audit
We run the full 15-point security checklist and 47 detection rules across all 8 threat classes, with line-level annotation.
Report
You receive a signed PDF with every finding, severity grades (critical / warn / info), and prioritised remediation steps. Delivered in 48 hours.
Everything in the $250 audit.
15-point review
Every file is evaluated against a 15-point security checklist covering prompt injection, data exfiltration, shell safety, credential handling, and more.
47 rules, 8 threat classes
Pattern-matching and semantic analysis across all 8 threat categories. Every rule cites what it looks for and why it matters.
Severity-graded report
Each finding references the exact line, the rule that triggered, and a severity grade: critical, warn, or info. Sorted by remediation priority.
Audit report you can share
A signed PDF delivered to your inbox within 48 hours. Share it with your security team, include it in compliance reviews, or pin it to your repository.
File separation analysis
We evaluate how your CLAUDE.md, AGENTS.md, and SKILL.md files are structured, whether concerns are separated correctly, and where overlap creates risk.
Context budget review
Skill files consume context window tokens. We review your files for redundancy, verbosity, and instructions that could be simplified to reduce token cost.
Built by a team that uses these files daily.
The Automation Switch team.
This audit is performed by the team behind Automation Switch. We published the Agent Skills Security Audit Guide backed by 40+ sources, maintain a Skills Directory indexing 20+ skill repositories, and operate a production platform (Scaletific) where we use SKILL.md files daily across Go, Python, Next.js, and Terraform projects.
Every audit follows the same methodology we use internally. The 15-point checklist and 47 detection rules were developed from real incidents documented in our research, and refined through our own production experience.
- 15-point security checklist per file
- 47 detection rules across 8 threat classes
- Line-level annotation with severity grades
- File architecture review (separation of concerns)
- Token efficiency analysis
- Prioritised remediation steps
- Backed by 40+ research sources
Questions worth answering.
If you are thinking about running a third-party skill inside an agent that has access to your code, shell, or cloud, you should ask these.
What files do you audit?+
SKILL.md, CLAUDE.md, AGENTS.md, .cursorrules, and copilot-instructions.md. If you have custom agent configuration files, include them and we will review those too.
How long does it take?+
48 hours from the time you upload your files to the delivery of a signed PDF report.
What do I get?+
A signed PDF report with line-level findings, severity grades (critical / warn / info), and prioritised remediation steps. Each finding references the detection rule that triggered it.
Who performs the audit?+
The Automation Switch team, using our 15-point security checklist and 47 detection rules. We published the Agent Skills Security Audit Guide backed by 40+ sources and use SKILL.md files daily across production projects.
Is my code safe with you?+
Files are reviewed, findings are documented, and source files are deleted within 7 days of report delivery. We store only the final report for your reference.
Go deeper on agent skill security.
Agent Skills Security Audit Guide
8 vulnerability types with CVEs, 15-point audit checklist, and 8 real incidents. The full methodology behind this service.
02Best SKILL.md Files Every Developer Should Install
21 production-tested skills across code review, testing, DevOps, and security. Each one verified for quality and safety.
03SKILL.md Templates by Project Type
Starter templates for Next.js, Python, Go, DevOps, data analysis, and React Native. Copy, customise, deploy.
04SKILL.md vs AGENTS.md vs CLAUDE.md
Decision matrix for choosing the right config file. Token budget analysis, project structures, and common mistakes.
05What Is SKILL.md and How to Write One
The complete guide to agent skill files. Anatomy, categories, and the growing directory of community-built skills.
06SKILL.md Directory
Browse curated skill sources for Claude Code, Cursor, Copilot, Windsurf, and Aider. Filterable by platform and domain.
One audit. $250. 48 hours.
Submit your email to book. We will confirm your booking and send a secure upload link for your skill files within one business day.
- 15-point security checklist applied to every file
- 47 detection rules across 8 threat classes
- Line-level findings with severity grades
- Signed PDF report with remediation priorities
- File architecture review (CLAUDE.md + AGENTS.md + SKILL.md separation)
- Token efficiency analysis
- Delivered in 48 hours
We email you to collect files and confirm payment. Your source files are deleted within 7 days of report delivery. Privacy policy.
Screen every skill before it touches your agent.
$250. 48-hour turnaround. A signed PDF report with every finding, severity grade, and remediation priority. Performed by humans with a published methodology.