[VibeDefend] Agent Skills Security Audit

Skills extend what your coding agents can do, and they run with the agent’s permissions: a single malicious skill can turn your agent against your own codebase. This audit scans every skill your agents load, both instructions and bundled scripts, to detect hidden or obfuscated instructions (invisible Unicode characters, encoded payloads), prompt injection and instruction override attempts, secret and data exfiltration (reads of .env files, SSH keys or credentials, calls to unknown domains), dangerous commands and persistence mechanisms, permissions broader than the skill’s stated purpose, and suspicious changes between versions. Each skill gets a risk verdict, and untrusted skills can be blocked before your agent uses them.