Skill Guardian

Pre-installation security gate for agent skills. This skill should be used when the user or agent attempts to install any skill — including requests like "install X", "add X skill", "help me set up the X skill", "npx skills add", or when the agent autonomously decides to install a skill. Also triggers on skill cleanup and audit requests like "clean up my skills", "check installed skills", "any unused skills", "review my skills", or "audit my skill list". Do NOT use for MCP server installation, npm/pip package installation, or non-skill tooling.

5 starsAI, LLMs & Agents

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add 0xtresser/skill-guardian --skill skill-guardian

Manual install

git clone --depth 1 https://github.com/0xtresser/skill-guardian.git /tmp/skill-guardian
mkdir -p ~/.claude/skills
cp -r /tmp/skill-guardian/. ~/.claude/skills/skill-guardian

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# Skill Guardian

Pre-installation security scan + necessity assessment gate. Cleanup auditor for installed skills.

## Hard Rule

**Before executing ANY `npx skills add`, complete ALL steps in the Installation Gate below.**

- Never install without completing the full gate.
- Never install without explicit user confirmation.
- Never skip steps for efficiency.
- Never install silently in the background.

## Installation Gate

Execute these 4 steps sequentially when intercepting any skill installation request.

### Step 1: Security Scan

1. Parse the target skill: extract `<owner>/<repo>` and `<skill-name>`.

2. Clone to temp — **do NOT install to the agent skill directory**:
   ```bash
   git clone --depth 1 https://github.com/<owner>/<repo>.git /tmp/sg-scan-$$
   ```

3. Run security scanner. Try in order, use the first available:

   **Option A** — `snyk-agent-scan` (preferred; requires `SNYK_TOKEN` env var):
   ```bash
   uvx snyk-agent-scan@latest --skills /tmp/sg-scan-$$/<skill-name>/SKILL.md --json
   ```

   **Option B** — Legacy `mcp-scan` (no token needed, outdated):
   ```bash
   uvx mcp-scan@latest --skills /tmp/sg-scan-$$/<skill-name>/SKILL.md
   ```

   **Option C** — Neither available → skip to Step 1b.

4. Interpret scan results by issue code prefix:

   | Code prefix | Severity | Action |
   |-------------|----------|--------|
   | `E` (E001–E006) | Critical | **Block.** Report threat details. No override option. |

Read the full skill on GitHub

Details

Skill name: skill-guardian
Repository: 0xtresser/skill-guardian
License: MIT
Repo updated: 10 March 2026

FAQ

What does the Skill Guardian skill do?

How do I install the Skill Guardian skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add 0xtresser/skill-guardian --skill skill-guardian. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Skill Guardian popular?

It lives in 0xtresser/skill-guardian, which has 5 GitHub stars and 0 forks.

Related skills

Tribeunal

tribeunal/mcp-server

Use when a decision needs more than one opinion — a dispute between two parties, a verdict or ruling someone will act on, a team decision nobody can settle, a poll or a vote, an arbitration clause, an escrow release waiting on who is right, or any question better answered by a jury of people and AI agents than by a single model, even if they never say Tribeunal

AI, LLMs & Agents

Skill Evolution

rwang23/skill-evolution

Turn repeated usage evidence and user feedback into reviewable Skill or harness improvement proposals. Use for Skill evolution, routing regressions, eval or hook improvements, and 技能进化或优化; not for applying changes or one-off edits.

AI, LLMs & Agents

Wikipedia Not AI

Valpep/wiki-ai-detector

Detect AI-generated text by identifying characteristic patterns, phrases, and structural tells from LLMs like ChatGPT, Gemini, and others. Use when the user wants to check if a text was written by AI, audit content for AI tells, clean up AI-generated writing to make it less detectable, understand what makes text sound AI-generated, or review emails, articles, reports, marketing copy, or any prose for AI markers.

AI, LLMs & Agents

Semantic Compression

therealmoronto/claude-semantic-compression

Apply semantic logic compression (Ovchinnikov method) when crafting prompts for LLMs or describing complex conditional logic. Use this skill whenever the user asks to: write or optimise a prompt for an LLM, compress or rewrite a task description, describe multi-condition business logic (if/and/or/not chains), or asks why an LLM misunderstood their instructions. Also trigger when the user says ‘compress the logic’, ‘write a prompt for’, ‘the LLM doesn't understand’, ‘simplify the conditions’, or similar intents. Also trigger when the user wants to use output modifiers such as →code or →no-meta,

AI, LLMs & Agents

World Events Briefing

chenxihuang1028-a11y/world-events-briefing

Use when the user wants a country / major-world-events news briefing ("全球时事简报") — armed conflicts, elections, disasters, business/economy, law/crime — pulled from Wikipedia's human-curated "Portal:Current events" daily pages and the GDELT DOC 2.0 article-search API. This is NOT the AI/tech skill (that's the sibling ai-news-briefing). One of only two Skills in the collection that calls the network (skill.json permissions.network=true) — it still needs zero user API keys. Offline fixture mode is available for fully deterministic, zero-network runs.

AI, LLMs & Agents

Reinit

aisk/reinit

Review available recent code-agent history and tool calls, then update the current repository's durable agent guidance with repeatedly needed facts and user-corrected conventions. Run only when the user explicitly invokes /reinit, $reinit, or names the reinit skill; never invoke automatically.

AI, LLMs & Agents

Browse the most popular Claude skills, all ai, llms & agents skills, or write your own with the skills generator.