Mikhail Diesperov 為 Codex、Claude Code 和 Cursor 製作 CEO AI 技能，協助討論任務及與 AI Agent 協作

Hi! I made a skill for Codex, Claude Code, and Cursor. I wanted an assistant I could talk through tasks with, and one that would occasionally stop me from doing something questionable when I'm tired. For example, before rewriting an entire service, it should help me figure out what's actually slow and whether a rewrite is needed at all. I took inspiration from Grill Me and Superpowers.

While building it, I started thinking about security. We install other people's skills, generate our own, and connect agents. We don't always check what's written in those instructions. I looked into several scanners, tested them, and added checks during indexing to CEO AI. It examines selected skills and agent definitions, looks for suspicious instructions, and shows what hasn't been checked. It doesn't execute the instructions it's checking.

The basic check runs locally, without Docker or paid API calls. The plugin also includes an optional deeper scan that needs Docker and a prepared scanner image. You only need those if you want to run that scan. These checks won't catch everything, but I feel better having a chance to spot at least some of the problems.

Code and installation are in the repository and on the website. I'm still refining it for my own tasks. I'm curious how others handle this: do you check skills before installing them, or do you trust the author for now?

AI helped draft and translate this post.