Janitor Security Agent Skill
Heuristic security scan of installed skills — prompt-injection phrases, hidden unicode instructions, credential-store access, network-pipe-to-shell and payload-smuggling patterns. Use when the user asks 'are my skills safe', wants to scan skills for prompt injection or malware patterns, or before trusting a newly installed skill. Trigger with '/janitor-security'.
Install
one command, takes just this skill from the repositorynpx skills add https://github.com/khendzel/skills-janitor --skill janitor-securityWhat it tells the agent to use
found in the instruction textThe instruction itself
13 sections, as written by the authorSecurity Scan
Heuristic scan of skill content for prompt-injection and malicious patterns.
Overview
A skill is text your agent trusts: its SKILL.md is read as instructions and its scripts run on your machine. Public research (Snyk's ToxicSkills, 2026) found prompt injection in roughly a third of tested community skills. This scan flags the known bad shapes across every installed skill, in every scope (user, project, codex, plugin):
- Injection phrases — "ignore all previous instructions", "do not tell the user"
- Hidden instructions — imperative text in HTML comments (invisible when rendered), zero-width/bidi unicode between plain characters
- Payload smuggling — large decodable base64 blobs in markdown
- Dangerous scripts — network piped into a shell (
curl … | bash), decode-and-execute, credential-store access (~/.ssh,~/.aws, keychain), URL shorteners, plain-HTTP calls, uploads of variable data
Findings are heuristics, not proof: a RISK verdict means "read this before trusting it". Legit tools trip these rules too (e.g. an installer that pipes curl into bash) — the point is that YOU see it and decide.
Prerequisites
- Claude Code with the skills-janitor plugin installed (provides
scripts/security.sh) - bash 3.2+ (the stock macOS bash works; no external dependencies, no network access)
Instructions
Step 1: Run the scan
bash ~/.claude/skills/skills-janitor/scripts/security.sh # all installed skills
bash ~/.claude/skills/skills-janitor/scripts/security.sh --json # machine-readable
bash ~/.claude/skills/skills-janitor/scripts/security.sh --path ~/some/skill-dir # one directory
Step 2: Present verdicts honestly
Per-skill verdict: RISK (any HIGH finding), REVIEW (any MEDIUM), PASS. For each flagged skill show the finding titles, the file, and the evidence snippet. Do NOT call a finding "malware" — describe what the pattern does and let the user judge intent (e.g. "media-use pipes a HeyGen installer from the network into bash — a common install pattern, but verify the URL before trusting it").
Step 3: Recommend next steps
- RISK on a skill the user doesn't recognize or need →
/janitor-swipeor delete it outright - RISK on a known/trusted tool → read the flagged file once, then move on
- Before installing something new →
/janitor-discover <url>runs this same scan pre-install
Output
Summary line (Scanned: N | RISK: x | REVIEW: y | PASS: z) followed by flagged skills, each with severity-tagged findings, the file, and an evidence snippet. --json emits the full structured report.
Error Handling
- Error:
security.sh: No such file or directory
Solution: The plugin is installed under a different root — locate it with ls ~/.claude/skills or check the plugin cache.
- Error: Everything shows PASS but the user expected a finding
Solution: The scan covers markdown and script files up to 1MB, 200 files per skill; binaries and huge files are skipped. Check the specific file manually.
- Error: A trusted skill shows RISK
Solution: Expected for tools that legitimately use flagged patterns (installers, credential helpers). Read the evidence line — if it matches the tool's documented purpose, note it and move on. Verdicts are advisory; nothing is deleted.
Examples
Example 1: Full audit
Input: "Are my skills safe? Check for prompt injection."
Output: Run the scan, lead with the summary ("178 scanned, 2 RISK, 0 REVIEW"), then explain each flagged skill in plain language with its evidence, and close with a recommendation per skill.
Example 2: One suspicious folder
Input: "Scan ~/Downloads/cool-skill before I install it."
Output: Run with --path ~/Downloads/cool-skill and present the verdict; suggest /janitor-discover for the overlap check too.
Resources
- Scan engine (plugin-relative):
{baseDir}/../../scripts/security.sh /janitor-discover <url>— pre-install check (overlap + this security scan on the fetched SKILL.md)/janitor-report— general health check (errors, duplicates, broken skills)/janitor-swipe— delete what you don't trust
Other skills for the same job
different authors, same section of the catalogue
> FHIR REST endpoints (Patient, Observation, Encounter, Condition, MedicationRequest), (2) Validating FHIR resources and returning proper HTTP status codes and error responses, (3) Implementing SMART on FHIR authorization and OAuth scopes, (4) Working with Bundles, transactions, batch operations, or search pagination. Covers FHIR R4 resource structures, required fields, value sets (status codes, gender, intent), coding systems (LOINC, SNOMED, RxNorm, ICD-10), and OperationOutcome error handling.
Interact with ClawDirect, a directory of social web experiences for AI agents. Use this skill to browse the directory, like entries, or add new sites. Requires ATXP authentication for MCP tool calls. Triggers: browsing agent-oriented websites, discovering social platforms for agents, liking/voting on directory entries, or submitting new agent-facing sites to ClawDirect.
Shared audit integrity framework for all AppSec agents — enforces output quality, intellectual honesty, and continuous improvement through anti-rationalization guards, self-critique loops, retry protocols, non-negotiable behaviors, self-reflection quality gates (1-10 scoring, ≥8 threshold), and a self-learning system with lesson/memory governance for security analysis agents.
Opt out of the OneCLI gateway and supply Anthropic credentials from .env instead. For users who want simple .env-based credential management without the OneCLI agent vault. Reads the API key or OAuth token from .env and injects it into the container's API requests.
Cross-product Zoom reference skill. Use after the workflow is clear when you need shared platform guidance, app-model comparisons, authentication context, scopes, marketplace considerations, or API-vs-MCP routing.
>- Static source-code vulnerability scan. Reads a target directory (and THREAT_MODEL.md if present), spawns parallel review subagents per focus area, and writes VULN-FINDINGS.json + .md for /triage to consume. Read-only — no building, running, or network. For execution-verified crashes, use vuln-pipeline instead. Use when asked to "scan for vulns", "review this code for security issues", "find bugs in <dir>", or as the step between /threat-model and /triage.
Hunt Session Management vulnerabilities — session fixation (no regeneration on login), insufficient invalidation on logout / password-change / email-change, predictable or low-entropy session IDs, JWT-as-session with no exp/revocation, refresh-token rotation/reuse-detection gaps, OAuth/SSO session linkage, device-bound-session (DBSC) downgrade, and cookie attribute issues (Secure/HttpOnly/SameSite/__Host-). Validate with TWO real sessions (attacker A + victim B), body-diff every 200, and OOB confirmation for theft chains. Medium to Critical (fixation→admin hijack, no-invalidation→persistent ATO).
> Use this skill when the user is doing hands-on DOCA AES-GCM work on a BlueField DPU or ConnectX NIC — configuring `doca_aes_gcm_task_encrypt` / `_task_decrypt`, querying `doca_aes_gcm_cap_*` for per-key-type (only `DOCA_AES_GCM_KEY_128` / `_256` — AES-192 not supported) and per-task support, sizing plaintext against the max-buf cap, setting source / destination mmap permissions, validating with a NIST GCMVS or RFC 5288 vector, or debugging DOCA_ERROR_* including the security-critical tag-verification-failed outcome on decrypt. Trigger even when the user does not explicitly mention "DOCA AES-GCM" or IO_FAILED", "auth tag isn't verifying", "NOT_PERMITTED on my encrypt buffer", "is AES-192-GCM on this BlueField" (no), or "encrypted record came back tampered". Refuse and route elsewhere for non-GCM AES modes (CBC / CTR / XTS — CPU OpenSSL), key management (KMS / HSM / rotation), SHA (doca-sha), or general AEAD background.
How to use it
Take khendzel/janitor-security from the repository into ~/.claude/skills for personal
use, or into .claude/skills inside a project.
The agent identifies a skill by the name field in its header. Two skills with the
same name cannot sit side by side — one of them will be ignored.