Trust Issues

Adversarial, attacker-minded security review of ANY untrusted code before you trust it — a GitHub repo, a Claude/agent skill, an MCP server, a plugin, an npm or pip package, or a snippet you are about to base your own skill on. ALWAYS run this BEFORE installing a skill or plugin, BEFORE connecting an MCP server, BEFORE running or importing third-party code, and BEFORE copying external code into a skill you are authoring. Trigger whenever the user says "is this repo safe", "check this skill/plugin/MCP for malware", "review before I install", "audit this code", "can I trust this", or asks you to

6 stars 2 forksAI, LLMs & Agents

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add howshannon/trust-issues --skill trust-issues

Manual install

git clone --depth 1 https://github.com/howshannon/trust-issues.git /tmp/trust-issues
mkdir -p ~/.claude/skills
cp -r /tmp/trust-issues/. ~/.claude/skills/trust-issues

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# Trust Issues

An adversarial security review for untrusted code. The job is to surface everything
that could reasonably concern a security expert, rather than to sign off on the code as
safe. Approach it like an attacker first and a defender second, and stay skeptical
throughout.

## Why this exists (and its honest limits)

Agent skills, MCP servers, and plugins are just code plus natural-language
instructions that an AI will read and often execute. A malicious one can steal
credentials, exfiltrate files, or hijack the agent through instructions hidden in a
`SKILL.md`. Real campaigns have shipped hundreds of malicious skills that installed
info-stealers on victims' machines.

Be clear-eyed about what a scan can and cannot do. Published research shows that
signature-based skill scanners are **routinely evaded** — the same malware reshaped
to look benign slipped past eight popular scanners across ~1,600 real malicious
skills. So the pattern scan here is the *floor*, not the ceiling. Your real defenses,
in order, are: **(1) don't run untrusted code outside a sandbox, (2) least
privilege — never give an agent both the untrusted code and access to your secrets,
network, and files at once, and (3) adversarial human/LLM reasoning about intent.**
A grep that finds nothing changes none of that.

## The one rule that matters most

**Reviewing is not running.** Cloning/reading is safe; executing is not. During this

Read the full skill on GitHub

Details

Skill name: trust-issues
Repository: howshannon/trust-issues
License: MIT
Repo updated: 28 July 2026

FAQ

What does the Trust Issues skill do?

How do I install the Trust Issues skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add howshannon/trust-issues --skill trust-issues. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Trust Issues popular?

It lives in howshannon/trust-issues, which has 6 GitHub stars and 2 forks.

Related skills

Agent Skill Builder

conorbronsdon/agent-skill-builder

Builds, reviews, or migrates agent skills. Use when creating a SKILL.md, auditing an existing skill, or converting a legacy Claude Code command.

AI, LLMs & Agents

Boss Zhipin

HideinbushZY/boss-zhipin-skill

Boss直聘招聘者侧网页操作 + 策略驱动寻访引擎。两类触发:(A) 单点操作——搜索候选人/看推荐牛人、读简历、打招呼、搜索畅聊、回复消息、求简历、查招聘数据/账号权益/牛人管理漏斗(换电话/换微信/约面/删除职位=永久红线只导航;关闭/发布职位=agent 可代操作,发布须提交前回读锁死字段+不买曝光);(B) 给一段搜索策略(JD/目标公司职位/人选能力要求)让它自动找人筛人触达并反馈——此时按 playbook.md 跑寻访管线。通过 browser-act 接管已登录的真实 Chrome(chrome-direct)执行。触发后先读 operation-map.md(怎么点页面)+ playbook.md(策略怎么跑)。

AI, LLMs & Agents

Agentic Data Science Competition

Mirannonarbitrable290/agentic-kaggle-skill

AI Agent-driven Kaggle competition workflow. Learn from real competition experience: score stabilization patterns, submission troubleshooting, kernel workflows, GPU task delegation, and the spec-driven development approach that achieved top leaderboard positions. Use when: working on any Kaggle competition, analyzing submission failures, setting up automated pipelines, or replicating top notebook solutions.

AI, LLMs & Agents

Claude Recall

senapati484/claude-recall

Always-on Claude Code skill that bridges Claude with an Obsidian vault for persistent project memory. Automatically loads relevant context nodes from mindmap.json before every prompt (UserPromptSubmit hook) and saves structured session notes to the vault on exit (Stop hook). Zero manual invocation — hooks fire automatically. Context is AUTO-GENERATED using the claude CLI. Claude analyzes transcripts and project files to populate mindmap.json with stack, architecture decisions, gotchas, and current state. Users never need to manually edit. The /recall command lets users trigger on-demand contex

AI, LLMs & Agents

AI News Fetcher

MohamedMamdouh18/AI-News-Fetcher

Fetches and summarizes the latest AI news from across the internet — including tech blogs, research outlets, newsletters, and news sites — then renders a polished interactive digest as a React artifact in chat. Trigger this skill whenever the user asks about recent or latest AI news, developments, breakthroughs, releases, or anything like "what's new in AI", "AI news this week", "catch me up on AI", "latest AI updates", or specifies a time window like "AI news in the last 3 days / week / month". Also trigger for queries like "what happened in AI recently", "any new model releases", "AI headlin

AI, LLMs & Agents

AI Hackathon

gd452/ai-hackathon-skill

AI 해커톤 운영 playbook + 로컬 운영 dashboard. clone → bun install → "ai-hackathon 시작해줘" 한마디로 localhost 에 운영 콘솔 띄움. 3 모델 (Claude·Gemini·ChatGPT) 이 팀 설명 markdown + 자동 수집한 GitHub 코드 evidence + Gemini Video 가 분석한 YouTube 시연 영상까지 함께 검토하여 독립 채점, 동료 평가·심사위원과 가중 합산. 사용 시점 — "해커톤 운영", "AI 심사", "rubric 채점", "리더보드", "참가자 안내", "다중 AI 평가". dashboard/ Next.js 앱 + scripts/ 실행 셸. 외부 의존성 = jq + curl + bun + git + ANTHROPIC/GEMINI/OPENAI 키 (.env.local). 외부 호출 = 3 LLM API + public GitHub HTTPS clone + Gemini Video YouTube URL. LLM CLI 별도 설치 불필요.

AI, LLMs & Agents

Browse the most popular Claude skills, all ai, llms & agents skills, or write your own with the skills generator.