Audit and Remediate Agent Skills Automatically

Where this fits

You maintain several dbt skills published via skills.sh. One afternoon a collaborator flags a "Warn" badge on your skill page from Socket. You need to understand the supply-chain risk, verify whether it requires action, and get a fix committed. Instead of manually opening three audit detail pages and parsing findings, auditing-skills gives your agent a structured workflow for checking and remediating published skills.

Why agents benefit

• Fetches audit statuses from Gen Agent Trust Hub, Socket, and Snyk and maps Pass/Warn/Fail to concrete next steps.
• Reads each auditor's detail page pattern to isolate the exact finding: remote code execution, prompt injection, dependency risk, or credential exposure.
• Generates remediation guidance in the context of your local skill code, so the agent can patch files instead of just reporting problems.
• Supports an iterative loop: check audit, fix, re-check, and confirm the badge moves to Pass.
• Works across multiple skills, allowing an agent to prioritize fixes by severity across an organization's whole catalog.

Practical scenarios

Pre-publish security gate

Before releasing a new version of a skill, the agent runs auditing-skills against the staging skill page. It catches a Snyk warning about a hardcoded credential reference in an example, then rewrites the example to use an environment variable before publication.

Triage inbound audit reports

Your security team forwards audit results from skills.sh or Tessl. The agent parses the findings, correlates them with local skill files, and creates issues with exact line references and suggested patches.

Bulk remediation after scanner changes

A scanner updates its rules and several published skills now fail. The agent audits every skill, groups common root causes, applies a consistent fix across repositories, and verifies each one passes.

Add it to your agent workflow

Install the skill with:

npx skills add dbt-labs/dbt-agent-skills --skill auditing-skills

Then prompt your agent with something like: "Check https://skills.sh/myorg/dbt-utils for audit warnings and fix any Fail findings." The agent fetches the relevant pages, uses the skill instructions to identify the remediation, edits your skill files, and reruns the audit. If your team relies on Tessl, use the same workflow with audit results exported from that tool.

Compare before adopting

Compare these signals before adopting:

• Quality signals: Does the skill still match current audit schemas? Review recent README and source changes.
• Maintenance freshness: Skills.sh and Tessl change audit endpoints and badge formats; this skill needs active updates.
• Alternatives: Generic web scraping or manually prompting an agent with audit site URLs may cover simple cases but won't scale.
• Workflow fit: It is marked internal: true by dbt-labs, so verify that its automation matches your own publishing pipeline.

Why it is worth tracking

dbt-labs is a credible maintainer, and 700+ stars signal real adoption among agent-skill developers. Security auditing for skills is still nascent, and the underlying scanners change often, so tooling like this is worth evaluating regularly. Track it, test it against your own published skills, and consider contributing if you rely on skills.sh. You can also track its trajectory and comparable skills on OpenAgentSkill at https://www.openagentskill.com/skills/dbt-labs-auditing-skills.