Security Skill
Anti Reversing Techniques
Understand anti-reversing, obfuscation, and protection techniques encountered during software…
$15
Skill Security Auditor
Audit newly added or updated skill files for security threats.
An automated security gate that audits every new or updated skill before it enters your ecosystem. It runs a 7-check matrix: four red-level checks (hardcoded secrets, eval and dynamic code execution, external data exfiltration, and cross-skill modification) that auto-reject, plus three yellow-level checks that flag routing clashes, over-broad scope, and structural gaps for human review. One malicious skill can compromise the whole ecosystem, so it scans in seconds and fails secure.
$15 one-time
Add to a kit → Prices include 20% VAT. · Forged on real agency work · one-time, no lock-in
- Type Skill
- Category Security
- Delivery Email · instant
- License One-time
Inside the run · no black box
See the actual work before you buy it.
One malicious skill poisons the whole ecosystem, so every new file passes a gate first. Four RED checks reject hardcoded secrets, eval calls, outbound exfiltration and cross-skill tampering; three YELLOW checks route ambiguity to human review.
- Read the full skill file, frontmatter, body and any bundled scripts; multi-file skills are audited file by file, symlinks resolved to their targets first.
- Run the 4 RED checks in strict order: R1 hardcoded secrets via regex plus Shannon entropy analysis, R2 eval() and new Function() usage, R3 outbound POST/PUT/PATCH calls to external URLs, R4 attempts to modify other skills' directories. The first RED hit means automatic reject, the audit stops there.
- Apply false positive filters before flagging anything: educational anti-pattern examples inside code blocks, regex definitions in detection tables and plain documentation links are recognized and skipped.
- Run all 3 YELLOW checks regardless of outcome: Y1 routing keyword clash above 60 percent overlap with existing skills, Y2 over-broad description spanning 5 or more domains, Y3 missing structural sections. Each YELLOW finding goes to human review, never silent auto-reject.
- Issue the verdict report, PASS, FAIL with the specific failing check, or REVIEW with a concrete recommendation, and write the audit trail with date and result so the decision is reconstructable later.
One power source. 6 lines out.
skill-security-auditor · core
core active · 6 lines
- ✓ auditing a skill before
Auditing a skill before installing it
- ✓ vetting third-party skills
Vetting third-party skills before import
- ✓ self-auditing skills gen…
Self-auditing skills generated by other tools
- ✓ catching hardcoded secrets
Catching hardcoded secrets and tokens in skill files
- ✓ detecting skills that try
Detecting skills that try to modify other skills
- ✓ periodic re-audit of an
Periodic re-audit of an entire skill library
Yours to keep.
Drag time forward. Watch what stays.
Forever
That's what owning means.
The rented stack
ai writing tool: subscription
expired · access lostanalytics suite: subscription
expired · access lostdesign platform: subscription
expired · access lost(nothing left)
Your forge
-
Block supply-chain attacks before a bad skill ever runs
license: perpetual -
Fail secure: anything uncertain is rejected or escalated, never silently accepted
license: perpetual -
Get a clear PASS / FAIL / REVIEW verdict with the specific reason
license: perpetual -
Add new skills with confidence instead of manual line-by-line inspection
license: perpetual
subscriptions expire · deeds don't
Everything in the box.
Pick a piece up. Watch it work.
Four auto-reject checks: secrets, eval, external exfiltration, cross-skill modification
6 parts · one working system · ships instantly by email
This wasn't forged for everyone.
- Not for you if you'd rather rent a tool than own one.
- Not for you if you want someone else to run your stack.
- Not for you if you're happy guessing.
Platform owners and teams running a skill marketplace or internal library who need every addition vetted against supply-chain threats.
then this was forged for you.Works with
Universal by design: these run in any AI. Delivered in the open Agent Skills + MCP format (native in Claude); ChatGPT, Gemini, Cursor and Copilot adapt the same files their own way.
- Claude Native format
- ChatGPT Adapts via open standards
- Gemini Adapts via open standards
- Cursor Adapts via open standards
- Copilot Adapts via open standards
Catch what's on your mind.
the air is clear. nothing between you and the forge.
catch a spark: the forge will answer
-
We install third-party skills weekly, does this fit into that flow?
Yes, it is designed as a gate: it runs automatically through the /install-skill command and scans in seconds, so vetting third-party or generated skills before import is the primary workflow, not an occasional audit.
-
What stops it from rubber-stamping a cleverly disguised malicious skill?
The matrix fails secure: four red-level checks (hardcoded secrets, eval, external exfiltration, cross-skill modification) auto-reject, secret scanning combines regex with entropy detection, and anything uncertain escalates to human review instead of passing silently.
-
Does a PASS verdict mean the skill is completely safe?
No. It is a static 7-check gate, not a sandbox or runtime monitor. Logic bugs, prompt-level manipulation, or behavior that only emerges at execution time are out of scope; PASS means no known static threat patterns were found.
-
How is it delivered?
By email right after purchase: ready to run, downloaded instantly, no setup wait.
-
One-time or subscription?
A one-time purchase; no subscription or hidden fees. VAT (20%) is included.
-
Can I get a refund?
As a digital product, it can’t be refunded once downloaded. That’s why we show exactly what’s inside and who it’s for, right here.