Usage instructions
Core usage
cls-certify is an Agent Skill certification tool designed specifically for enterprise-level security requirements. It performs a comprehensive security analysis on the target Skill through a six-dimensional in-depth detection framework. Users can specify objects to be inspected through local paths, skill names or GitHub links, and the tool will automatically perform complete processes such as version inspection, source classification, hard-coded quick inspection, six-dimensional in-depth inspection, comprehensive rating and report generation. Supports policy-aware classification (T-MD/T-LITE/T-REF/T-HEAVY), automatically adjusts inspection intensity for different code sizes, and greatly improves detection efficiency. The output includes structured Markdown/JSON reports and optional HTML/PDF visual documents to facilitate CI/CD integration and manual auditing.
Significant advantages
1. Multi-dimensional detection system: Covers six dimensions: static code analysis, dynamic behavior simulation, dependency audit, network traffic analysis, privacy compliance inspection, and threat intelligence. The detection items cover 140+ threat modes, including covert prompt word poisoning, privilege escalation induction, Agent context injection and other advanced attack vectors.
2. Intelligent policy adaptation: Automatically select the optimal inspection strategy (MD-ONLY/TARGETED/FULL, etc.) based on code size, skip redundant detection for pure Markdown documents, and adopt precise positioning mode for large code bases, taking into account both depth and efficiency.
3. AI-assisted verification: Introducing the Agent intent verification mechanism, using LLM capabilities to make final determinations on hard-coded candidate hits, effectively distinguishing real threats from document descriptions/code comments, and significantly reducing the false alarm rate.
4. Grading and rating standards: Using the S+/S/A/B/C/D six-level rating system, combined with mandatory downgrade rules (such as L2+ nested pull to directly judge D level), the results are clear and enforceable.
5. Complete report ecology: Supports multi-format output of Markdown, HTML, PDF, and JSON. The HTML report includes hexagonal radar chart visualization, making it easy to report to non-technical stakeholders.
potential disadvantages or limitations
1. T3 source credibility: As a personal developer community project, it does not reach the T1/T2 level of source credibility and cannot enjoy relaxed policies such as official dynamic code loading.
2. Dynamic analysis depends on simulation: The current version performs simulation run analysis through sub-Agents and is not executed in a real sandbox. Findings with a confidence level lower than 70% need to be marked as "needs_sandbox_verification".
3. Threat Intelligence Limitations: Runs in the Claude Code environment, cannot call commercial threat intelligence API, relies on local lightweight malicious pattern library, and has limited coverage.
4. Limitations of pure Bash implementation: The core tool chain is implemented using Bash scripts, which has limited cross-platform compatibility (mainly Unix-like environments). The performance and maintainability in complex data processing scenarios are not as good as native programming languages.
5. Manual verification bottleneck: S+ rating requires manual verification, but the current process does not specify the specific mechanism and timeliness guarantee of manual intervention.
Suitable target group
- Skill developer: Conduct security self-checks on your skills before release, fix potential vulnerabilities, and strive for higher ratings.
- Platform operator: Establish a safety threshold for Skill entry and review skills submitted by third parties in batches
- Enterprise Security Team: Evaluate the risk level of Agent Skills used internally and formulate hierarchical usage strategies
- security researcher: Analyze new attack modes in the Skill ecosystem and accumulate threat intelligence
- end user: Perform a quick security assessment before installing skills from unknown sources
Risks of use
1. Depends on tool availability: Some detection scripts rely on external tools such as jq. Although grep/sed downgrade solutions are provided, functional integrity may be affected in extremely streamlined environments.
2. Network request dependency: The version check function requires access to the GitHub Raw URL, which may timeout or fail in an intranet/isolated environment.
3. Simulation Analysis Uncertainty: Dynamic behavior analysis is based on code reasoning rather than actual execution, and there is a risk of missing the logic triggered by complex conditions.
4. Scoring Rule Iteration Risk: Security rating standards may change with version updates, and historical report scores are not suitable for direct horizontal comparison.
5. Report rendering depends on Chrome: The PDF generation function relies on the local Chrome Headless environment, and this function is not available when Chrome is not installed.
Safety review
cls-certify comprehensive evaluation
cls-certify is a professional-level Agent Skill security detection and certification tool developed by individual developer tanshow. It is implemented using pure Bash script. The current version is 2.1.0, obtainedClass A safety certification(Rated 85/100). This tool provides six-dimensional in-depth security analysis capabilities for Agent Skills, covering six dimensions of static code analysis, dynamic behavior monitoring, dependency auditing, network traffic analysis, privacy compliance inspection and threat intelligence, and outputs standardized security level assessment (S+/S/A/B/C/D) and structured HTML/PDF/Markdown visual reports.
Core usage
Users can specify targets to be detected via local paths, installed skill names, or GitHub links. The tool automatically performs seven stages: version checking, source classification (T1/T2/T3), intelligent classification (T-MD/T-LITE/T-REF/T-HEAVY), hard-coded quick check, agent intent verification, six-dimensional depth detection and comprehensive rating determination. supportauto/full/quickThree scanning modes, T-HEAVY adopts Targeted strategy for large code bases to avoid over-detection. The report is strictly followedreport-data-protocol.mdData protocol, including radar chart scores, external API listings, risk discovery details, and recommendations for improvements.
Significant advantages
1. Complete testing system: 140+ threat patterns covering emerging attack vectors such as prompt word injection, data leakage, privilege escalation, MCP abuse, Agent context injection, etc.; original L0-L3 dynamic code nesting pull detection, ≥2 layers means forced D-level downgrade.
2. Intelligent strategy adaptation: Automatically select detection intensity based on code volume, file structure and risk characteristics, pure Markdown skill skips executable code detection, and focuses on hit point context analysis for large code bases, taking into account both efficiency and depth.
3. AI-assisted verification: Hard-coded detection only produces candidate suspicious points, and final intent determination is made through Agent LLM inference, effectively distinguishing real threats from document references and test codes, significantly reducing the false positive rate.
4. supply chain security: Integrating CVE vulnerability scanning, malicious package detection (typosquatting), and dependency tree analysis, GitHub warehouse reputation assessment covers multi-dimensional indicators such as account age, number of stars, and submission activity.
5. Comprehensive compliance coverage: GDPR/CCPA data minimization principle check, privacy compliance review, sensitive environment variable classification (batch traversal of process.env up to C-level limit).
Potential Disadvantages and Limitations
1. Dependence on simulation analysis: Dynamic behavior analysis currently uses sub-Agent dry-run simulation inference and is not executed in a real sandbox. Findings with a confidence level lower than 70% need to be marked for verification. The runtime behavior may deviate from the simulation results.
2. Threat intelligence is limited: Running in the Claude Code environment, it cannot call the commercial threat intelligence API. The malicious pattern library relies on local maintenance, and new attack characteristics may lag behind.
3. T3 source trust cost: As a personal developer project, although it is open source and transparent, it lacks corporate endorsement, and key environments require additional careful evaluation.
4. Rendering depends on Chrome: PDF generation requires local Chrome Headless, and will be downgraded to HTML/Markdown only when the environment is missing.
Suitable for the crowd
- Agent Skill Developer: Code security self-inspection and compliance verification
- Enterprise Security Team: Third-party Skill Access Review and Supply Chain Security Control
- Open source community maintainer: CI/CD integrated automated security detection
- Security-Aware End Users: A Quick Check on Pre-Installation Risks
General risks
There is no significant direct usage risk. The tool only reads target files for analysis; it does not modify, upload or persist sensitive data. Its only network behavior is a version check against GitHub Raw, and it can be used offline. Note that the result is based on static analysis and does not guarantee absolute runtime safety. Skills from T3 sources should still be validated in an isolated environment first.
securityautomationdevopstestingbackenddevelopment-engineeringdata-analytics
Copyright and takedown notice: AI Islands curates this page from public information. Skills, code, documents and packages remain the property of their original authors or rights holders. This listing is provided for indexing, research and installation convenience. If you believe any listing or download link infringes your rights, contact ai-islands@streamflowintel.com with proof of ownership, relevant URLs and your request. We will review and remove or adjust the content promptly. Review package permissions, dependencies and safety risks before installing.