Community生产力与协作github.com

getsentry/skill-scanner

扫描智能体技能以发现安全问题。当被要求“扫描技能”、“审计技能”、“审查技能安全性”、“检查技能是否存在注入”、“验证SKILL.md”或评估智能体技能是否安全安装时使用。可检查提示注入、恶意脚本、过度权限、秘密泄露及供应链风险。

skill-scanner 是什么？

getsentry/skill-scanner 是一个专门用于审计 AI 智能体技能安全性的工具。它能够自动检测技能可能存在的安全风险，包括提示注入（Prompt Injection）、恶意脚本、权限配置过高、敏感信息（如 API 密钥）泄露以及供应链安全风险。该工具支持在 Claude Code、Cursor 等主流 AI 开发环境中使用，用户只需在对话中提出“扫描技能”、“审计技能”或“验证SKILL.md”等请求，即可触发安全扫描。其工作原理是解析 SKILL.md 文件中的指令、命令和依赖声明，结合内置的安全规则库进行静态分析，并生成详细的报告，帮助开发者判断是否安全安装某个技能。对于 AI 代理用户来说，这个技能是防止恶意技能侵入工作流的第一道防线。

兼容平台✓Claude Code~Codex CLI~Cursor
Part ofAgent Workflows
npx skills add https://github.com/getsentry/skills/tree/main/skills/skill-scanner

Installed? Explore more 生产力与协作 skills: steipete/gemini, steipete/gh-issues, steipete/skill-creator · View all 6 →

查看原文→浏览所有技能

在你喜欢的 AI 中提问

打开一个已预加载此 Agent Skill 的新对话。

OpenAIChatGPTClaudeClaudeGeminiGeminiGrokGrokPerplexityPerplexityDeepSeekDeepSeek

文档

skill-scanner 是做什么的？

扫描智能体技能以发现安全问题。当被要求“扫描技能”、“审计技能”、“审查技能安全性”、“检查技能是否存在注入”、“验证SKILL.md”或评估智能体技能是否安全安装时使用。可检查提示注入、恶意脚本、过度权限、秘密泄露及供应链风险。

功能

  • 提示注入检测：检查技能是否包含可能被恶意利用的注入模式。
  • 恶意脚本分析：扫描技能中是否存在试图执行危险操作的脚本。
  • 权限检查：评估技能索取的权限是否超出实际需求。
  • 秘密泄露扫描：检测技能是否意外暴露了 API 密钥、令牌等敏感信息。
  • 供应链风险评估：分析技能依赖的第三方组件是否存在已知的安全漏洞。

使用方法

在你的智能体（如 Claude Code、Cursor、Codex）中，直接说出以下任一指令：

  • "扫描这个技能的安全问题"
  • "审计当前技能"
  • "审查技能安全性"
  • "检查技能是否存在注入"
  • "验证 SKILL.md"
  • "这个技能安全吗？"

工作原理

  1. 读取目标技能的 SKILL.md 文件。
  2. 将文件内容与内置的安全规则库进行对比。
  3. 分析命令列表、环境变量、文件操作等高风险元素。
  4. 生成包含风险等级、问题和建议修复措施的报告。

支持的平台

  • Claude Code
  • Cursor
  • Codex
  • 其他基于技能的 AI 代理

许可证

MIT

Individual skills in this repo

This repo contains 20 individual skills — each has its own dedicated page.

getsentry/agents-md

Creates and maintains concise AGENTS.md and CLAUDE.md project instruction files. Use when asked to create AGENTS.md, update AGENTS.md, maintain agent docs, set up CLAUDE.md, document repository agent conventions, or keep coding-agent instructions minimal and reference-backed.

getsentry/blog-writing-guide

Write, review, and improve blog posts for the Sentry engineering blog following Sentry's specific writing standards, voice, and quality bar. Use this skill whenever someone asks to write a blog post, draft a technical article, review blog content, improve a draft, write a product announcement, create an engineering deep-dive, or produce any written content destined for the Sentry blog or developer audience. Also trigger when the user mentions "blog post," "blog draft," "write-up," "announcement post," "engineering post," "deep dive," "postmortem," or asks for help with technical writing for Sentry. Even if the user just says "help me write about [feature/topic]" — if it sounds like it could become a Sentry blog post, use this skill.

getsentry/brand-guidelines

Write copy following Sentry brand guidelines. Use when writing UI text, error messages, empty states, onboarding flows, 404 pages, documentation, marketing copy, or any user-facing content. Covers both Plain Speech (default) and Sentry Voice tones.

getsentry/claude-settings-audit

Analyze a repository to generate recommended Claude Code settings.json permissions. Use when setting up a new project, auditing existing settings, or determining which read-only bash commands to allow. Detects tech stack, build tools, and monorepo structure.

getsentry/code-simplifier

Simplifies and refines code for clarity, consistency, and maintainability while preserving all functionality. Use when asked to "simplify code", "clean up code", "refactor for clarity", "improve readability", or review recently modified code for elegance. Focuses on project-specific best practices.

getsentry/commit

ALWAYS use this skill when committing code changes — never commit directly without it. Creates commits following Sentry conventions with proper conventional commit format and issue references. Trigger on any commit, git commit, save changes, or commit message task.

getsentry/create-branch

Create a git branch following Sentry naming conventions. Use when asked to "create a branch", "new branch", "start a branch", "make a branch", "switch to a new branch", or when starting new work on the default branch.

getsentry/django-access-review

Django access control and IDOR security review. Use when reviewing Django views, DRF viewsets, ORM queries, or any Python/Django code handling user authorization. Trigger keywords: "IDOR", "access control", "authorization", "Django permissions", "object permissions", "tenant isolation", "broken access".

getsentry/django-perf-review

Django performance code review. Use when asked to "review Django performance", "find N+1 queries", "optimize Django", "check queryset performance", "database performance", "Django ORM issues", or audit Django code for performance problems.

getsentry/doc-coauthoring

Guide users through a structured workflow for co-authoring documentation. Use when user wants to write documentation, proposals, technical specs, decision docs, or similar structured content. This workflow helps users efficiently transfer context, refine content through iteration, and verify the doc works for readers. Trigger when user mentions writing docs, creating proposals, drafting specs, or similar documentation tasks.

getsentry/find-bugs

Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.

getsentry/gha-security-review

GitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to "review GitHub Actions", "audit workflows", "check CI security", "GHA security", "workflow security review", or review .github/workflows/ for pwn requests, expression injection, credential theft, and supply chain attacks. Exploitation-focused with concrete PoC scenarios.

getsentry/gh-review-requests

Fetch unread GitHub notifications for open PRs where review is requested from a specified team or opened by a team member. Use when asked to "find PRs I need to review", "show my review requests", "what needs my review", "fetch GitHub review requests", or "check team review queue".

getsentry/iterate-pr

Iterate on a PR until actionable CI passes and high/medium review feedback is addressed. Use for PR CI failures, review feedback, or green-check loops; do not wait for human approval, draft status, or merge gates.

getsentry/presentation-creator

Create data-driven presentation slides using React, Vite, and Recharts with Sentry branding. Use when asked to "create a presentation", "build slides", "make a deck", "create a data presentation", "build a Sentry presentation". Scaffolds a complete slide-based app with charts, animations, and single-file HTML output.

getsentry/pr-writer

Create, refresh, and rewrite PR titles and descriptions following Sentry conventions. Use when opening a PR, writing or updating a PR title/body/description, refreshing an existing PR after material changes, or preparing branch changes for review.

getsentry/security-review

Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.

getsentry/skill-writer

Create, synthesize, and iteratively improve agent skills following the Agent Skills specification. Use when asked to "create a skill", "write a skill", "synthesize sources into a skill", "improve a skill from positive/negative examples", "update a skill", or "maintain skill docs and registration". Handles source capture, precision passes, authoring, registration, and validation.

getsentry/sred-project-organizer

Take a list of projects and their related documentation, and organize them into the SRED format for submission.

getsentry/sred-work-summary

Go back through the previous year of work and create a Notion doc that groups relevant links into projects that can then be documented as SRED projects.

相关技能

steipete/gemini

Gemini CLI one-shot prompts, summaries, generation, skills, hooks, MCP, or Gemma routing.

community

steipete/gh-issues

Fetch GitHub issues, select candidates, spawn background fix agents, open PRs, and optionally process PR review comments.

community

steipete/skill-creator

Create, edit, audit, tidy, validate, or restructure AgentSkills and SKILL.md files.

community

steipete/clawhub

Search, install, update, sync, or publish agent skills with the ClawHub CLI and registry.

community

steipete/coding-agent

Delegate coding work to Codex, Claude Code, or OpenCode as background workers; not simple edits or read-only code lookup.

community

steipete/mcporter

List, configure, authenticate, call, and inspect MCP servers/tools with mcporter over HTTP or stdio.

community
← More 生产力与协作 skills