arc-security-audit_skill

Overview

This skill performs a comprehensive security audit across an agent's full skill stack, combining scanning, trust assessment, binary verification, and health checks into a single pass. It produces a prioritized risk report and can optionally emit trust attestations for skills that meet integrity and provenance criteria. The tool is designed to reduce manual effort and present actionable remediation steps.

How this skill works

The skill scans installed skills using pattern-based signatures to detect risky code, unsafe dependencies, and suspicious artifacts. It then assesses trust by evaluating provenance, code cleanliness, and the presence of binaries, verifying binary integrity with SHA-256 checksums. Findings are normalized, prioritized by severity, and compiled into a unified JSON report, with an option to generate trust attestations for passing skills.

When to use it

• Before deploying or publishing an agent that bundles multiple third-party skills
• During routine security hygiene to find regressions or newly introduced risks
• When ingesting archived or third-party skill collections with unknown provenance
• Prior to acceptance testing in CI pipelines to gate high-severity issues
• When you need a consolidated view across scanners, attestations, and integrity checks

Best practices

• Run the full audit regularly and integrate it into CI to catch regressions early
• Use the JSON output to feed downstream triage tools or ticketing systems
• Treat critical and high findings as blockers for production deployment
• Enable trust attestations only after resolving outstanding integrity and provenance issues
• Keep a baseline snapshot of trusted skills to detect unauthorized changes

Example use cases

• Audit all installed skills on a developer workstation before a release
• Scan a single skill directory to verify fixes after a security patch
• Produce a machine-readable JSON report for automated compliance checks
• Generate trust attestations for a curated skill set to distribute to consumers
• Validate archived skill bundles for integrity and provenance before import