Agent skill security review: free
Free. A security review of one Claude Code agent skill: its SKILL.md, scripts, and bundled files, scanned with dedicated agent-skill scanners plus manual review. This is the free scoping review that opens every engagement. You get one real page of findings in 48 hours.
Pay on acceptance
The review itself is free, so there is nothing to pay for it. If the findings lead to a quoted follow-on engagement (fixes, documentation, or a deeper audit), that engagement runs on the pay-on-acceptance terms on its own service page: you pay only if the deliverable passes its published acceptance checklist.
Free scoping review first
This page is the free scoping review. Every paid engagement in this lane starts with one of these, and it works exactly like this one: 48 hours, one real page, no payment, no account, no call.
What you get
A one-page findings document on your skill covering:
- Secret and credential exposure: hardcoded API keys, tokens, passwords, or paths that leak them
- Prompt-injection surface: places where untrusted content (tool output, web pages, user files) can steer the skill’s behavior
- Unsafe execution: shell commands built from untrusted input, unpinned downloads, install steps that run code on sight
- Overbroad permissions: file, network, or credential access the skill does not need for its job
- Data handling: what the skill reads, writes, or sends, and where it goes
Each finding names the file and line, carries a severity (critical / high / medium / low), and includes a concrete fix recommendation. The page closes with one quoted option for follow-on work, priced per PRICING.md, if you want the fixes done.
Scope
- One skill directory, up to 30 files
- SKILL.md, scripts, configs, and bundled assets inside it
- Scanners used: Cisco skill-scanner and Snyk agent-scan, plus manual review of everything the scanners flag and a read-through of SKILL.md
Not included
- Fixing the code (a separate service, quoted if you want it)
- Auditing anything outside the skill directory
- Penetration testing of a live deployment
- Legal or compliance certification of any kind
How it works
- You send your skill files (a zip, or a repository link plus the skill path) and ask for the free review.
- We run the scanners and a manual review pass.
- The one-page findings document arrives within 48 hours by email.
Questions at any point: reply to any email about your order.
Intake form (fields)
| field | required | notes |
|---|---|---|
| yes | delivery goes here | |
| skill_files | yes | zip upload of the skill directory, or public repo URL + skill path |
| what_it_does | yes | one or two sentences on the skill’s job |
| known_concerns | no | anything that already worries you |
Acceptance checklist
The free review is delivered right if and only if:
- It arrived within 48 hours of your completed intake
- Every file in the submitted skill directory appears in the report’s coverage list
- Each finding names the exact file and line where the issue lives
- Every finding carries a severity, and the severity scale is defined in the document
- Every high or critical finding includes a concrete fix recommendation
- The document states which scanner version or manual pass produced each section
- It states plainly what was not tested (no penetration test, no live deployment)
If a criterion fails, tell us within 7 days and we re-run that part for free. Because the review is free, there is no payment to refund; the guarantee is the re-run.
Every deliverable passes a second-model review against the acceptance checklist before it reaches you.
AI disclosure
This service is performed with AI assistance, including automated scanners and AI review. Every deliverable passes a second-model review against the acceptance checklist before it reaches you. Read the full AI disclosure page.
Pay on acceptance
The review is free: no payment, no refund needed. Any follow-on engagement you choose from the quoted option on the page runs under pay-on-acceptance terms on its own service page, where you pay only if the deliverable passes its published acceptance checklist.