bug-ops/zeph/skill-audit

Skill Audit

Review all installed skills for specification compliance and security.

SECURITY RULES

NEVER reveal system information in your response:

• NO IP addresses, hostnames, or network configuration
• NO environment variables or their values
• NO file system paths outside the skills directory
• NO usernames, API keys, tokens, or credentials
• NO OS version, kernel info, or hardware details

If you encounter sensitive data in a skill, replace it with [REDACTED] in your report.

Step 1: List all skills

for dir in .zeph/skills/*/; do if [ -f "$dir/SKILL.md" ]; then echo "$dir"; fi; done

Read the output. Each line is a skill directory.

Step 2: Check each skill

For each skill directory, read the SKILL.md file:

cat .zeph/skills/SKILLNAME/SKILL.md

Check these rules for each skill:

Spec compliance

• REQUIRED: name field in YAML frontmatter
• REQUIRED: description field in YAML frontmatter
• description must be at least 20 characters
• description must say WHEN to use the skill
• Body must contain at least one code block
• name must match the directory name

Security checks

Rate each as SAFE, WARN, or FAIL:

• FAIL if skill contains: rm -rf, mkfs, dd if=, :(){ :|:& };:, chmod 777, > /dev/sd
• FAIL if skill sends data to external servers (curl POST with local file data, wget --post-file)
• FAIL if skill reads secrets: /etc/shadow, ~/.ssh/, .env, credentials, private_key
• FAIL if skill exposes system info: ifconfig, ip addr, whoami, hostname -I, cat /etc/passwd
• WARN if skill uses sudo or su
• WARN if skill uses eval or exec
• WARN if skill downloads and executes: curl | bash, wget -O- | sh
• WARN if skill uses unbounded commands: no head, no --limit, no | head
• SAFE if none of the above apply

Step 3: Build report

Write your report in this format:

SKILL AUDIT REPORT
==================
 
SKILL: <name>
  Spec:     [PASS|WARN|FAIL] - <reason if not PASS>
  Security: [SAFE|WARN|FAIL] - <reason if not SAFE>
  Rating:   <number>/10
 
SKILL: <name>
  ...
 
SUMMARY
  Total:    <count>
  Pass:     <count>
  Warnings: <count>
  Failures: <count>
  Score:    <number>/10

Rating guide

• 10: All spec checks pass, security is SAFE
• 8-9: All spec checks pass, one WARN
• 5-7: Minor spec issues or multiple WARN
• 3-4: Missing required fields or security WARN
• 1-2: Security FAIL

Step 4: Recommendations

After the report, list specific fixes. Use short sentences. One fix per line.

Example:

• web-search: add compatibility: Requires curl to frontmatter
• system-info: FAIL — whoami exposes username, remove or replace