forensify
Cross-agent self-inspection of your AI-agent stack. Audits skills, MCP servers, hooks, plugins, commands, credentials, and memory…
@alexgreenshInstall SkillSecurity
Skill
/clean-skill
A legitimate Codex skill with no threats
Claude Code
$ npx -y skills add alexgreensh/repo-forensics --skill clean-skill --agent claude-code
Codex
$ npx skills add alexgreensh/repo-forensics --skill clean-skill -a codex -y
Cursor
$ npx skills add alexgreensh/repo-forensics --skill clean-skill -a cursor -y
Gemini CLI
$ npx skills add alexgreensh/repo-forensics --skill clean-skill -a gemini-cli -y
GitHub Copilot
$ npx skills add alexgreensh/repo-forensics --skill clean-skill -a github-copilot -y
OpenCode
$ npx skills add alexgreensh/repo-forensics --skill clean-skill -a opencode -y
Windsurf
$ npx skills add alexgreensh/repo-forensics --skill clean-skill -a windsurf -y
SKILL.md
clean-skill.SKILL.mdname: clean-skill description: A legitimate Codex skill with no threats
Clean Skill
This is a benign skill used as a negative control in canary tests. It should produce zero findings from any scanner.
In this plugin
See everything inside Ships withrepo-forensics
Offline security scanner for AI-agent repos, skills, plugins, and MCP servers.
2015 skills
Stars on GitHub
Momentum
- stars in total
- 201
Other skills on repo-forensics.
@alexgreenshInstall Skillrepo-forensics
Security forensics for git repos, AI skills, and MCP servers. Audits dependencies, detects prompt injection, credential theft,…
@alexgreenshInstall Skillbenign
A Claude Code skill that performs automated code review on the current working repository.
@alexgreenshInstall SkillMore skills from other plugins.
api-security
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…
@zhaoxuya520Install Skillabusing-dpapi-for-cred…
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys)…
@mukul975Install Skillclean-user-facing-text
Clean and finalize authorized natural-language text intended for readers by auditing suspicious invisible Unicode and rewriting…
@guillaumemeyerInstall Skill
Questions about clean-skill.
- Which coding agents can use clean-skill?
- clean-skill installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.