From john-skills
Audits GitHub repositories for security risks before installation: reviews install scripts for malicious commands, source code for data exfiltration, and dependencies for suspicious packages.
npx claudepluginhub jbdamask/john-claude-skills --plugin john-skillsThis skill uses the workspace's default tool permissions.
Perform security audits on GitHub repositories to identify data exfiltration, malicious code, or suspicious behavior before installation.
Analyzes installed package source code for supply chain risks by scanning for eval, network calls, env access, and obfuscation. Scores packages and reports issues with file:line context for JS, Python, Rust, Go ecosystems.
Audits git repositories, AI skills, and MCP servers for security risks including dependencies, prompt injection, credential theft, runtime dynamism, manifest drift, CVEs, and exploited vulns.
Intercepts pip, npm, go installs to audit package identity, vulnerabilities, suspicious signals, and enforce lockfile hash pinning before execution.
Share bugs, ideas, or general feedback.
Perform security audits on GitHub repositories to identify data exfiltration, malicious code, or suspicious behavior before installation.
Fetch and analyze all install scripts for:
Examine main application code for:
Review dependency files (package.json, go.mod, requirements.txt, Cargo.toml):
Summarize findings with:
See references/red-flags.md for comprehensive list of suspicious patterns.
Install scripts:
curl | bash from non-official URLsSource code:
Dependencies:
analytics, telemetry, tracking packages## Security Review Summary: [Project Name]
### [Status Emoji] Install Script - [CLEAN/SUSPICIOUS/DANGEROUS]
[Findings]
### [Status Emoji] Application Code - [CLEAN/SUSPICIOUS/DANGEROUS]
[Findings]
### [Status Emoji] Dependencies - [CLEAN/SUSPICIOUS/DANGEROUS]
[Findings]
### Assessment
[Overall verdict and recommendation]
Use checkmarks for clean, warning signs for suspicious, X for dangerous.