AI agent skills and compliance: what HIPAA and SOC 2 audits will ask.

This is not legal advice. Compliance requirements differ by scope, industry, and assessment type. This post describes what auditors actually ask about third-party code, and how a deterministic scanner report answers it.

The question auditors ask

Your AI agents run skills. A skill is a folder of instructions and scripts that execute with the agent's permissions. Those skills are third-party code, and third-party code is in scope for HIPAA and SOC 2 assessments.

The audit question is not whether a skill is malicious. The question is how you know what this code does, and whether you can prove it. An auditor wants inventory, license clarity, vulnerability checks, and a change record.

Why skills break the usual answers

• No license. Our corpus of 4,000 public skills found 93.6% declare no recognizable license. Redistribution rights are unclear for almost the entire ecosystem. That is a license-review finding before any security finding.
• Installed like plugins. A marketplace install is not a code review. Snyk's ToxicSkills audit found 13.4% of 3,984 public skills had critical issues, and 76 confirmed malicious payloads.
• Runtime is too late. Once a skill runs, the damage is done. Scanning is the pre-deployment layer, and it is the layer that can say no.

What evidence looks like

A defensible artifact is deterministic. Same input gives the same report, so the auditor can reproduce it. Every finding carries a file and line, so a human can verify it by hand.

$ scanaskill . --severity highscanaskill 1.2.1 — .scanned 2 artifact(s), 3 finding(s)  ARTIFACT  [claude-skill] code-reviewer  ARTIFACT  [claude-skill] deploy-notifier  LOW      [license] No license declared           SKILL.md:1           Skill declares no license (frontmatter `license:` or LICENSE file). Redistribution rights unclear.  INFO     [network] URL in skill           SKILL.md:16  INFO     [network] URL in skill           SKILL.md:22  summary: critical=0 high=0 medium=0 low=1 info=2  note: findings are observed patterns, not verdicts. Review each before acting.$ scanaskill . --sbom | jq '.components[0]'{  "type": "library",  "name": "requests",  "version": null,  "purl": "pkg:pypi/requests",  "bom-ref": "pkg:pypi/requests"}

The report above is real CLI output. It lists findings with evidence, a severity summary, and an SBOM of extracted dependencies. The SBOM names the library, package URL, and version — the parts an inventory review asks for.

The proof artifact pattern

The strongest evidence is a public audit trail. A skill that ships with a published scan report, a pinned version, and a known checksum answers the inventory question in one step. The Trust Pack is built this way: every package passes a deterministic 10-check audit with zero high findings, and the audit reports are public.

Honest limits

• A scanner produces evidence, not a compliance certification.
• Static analysis can miss obfuscated code. It shrinks the problem; it does not remove it.
• Skills are one component. Agents, models, and data handling are separate scopes.

Start the audit trail today

The scanner is free, local, and open source. It never runs a skill and never sends data.

Paste a skill to see a quick scan in your browser, or read the two-minute audit guide for the full workflow.

Install the CLI: $ pipx install agentscan-cli