The risk of an agent skill call depends not on the skill alone but on the invocation context: the same file-reading skill is benign when listing logs, yet dangerous when tainted content steers the agent toward secret exfiltration. We formalize invocation-time auditing: intercept a proposed skill call before execution and score its risk from the user request, the candidate skill, and the runtime context. STARS implements this as a three-stage pipeline that fuses a static capability prior with a request-conditioned invocation scorer. The primary configuration, STARS-LLM, uses an LLM judge; STARS-Rules is a deterministic, API-free alternative. On SIA-Bench, a 3,000-record synthetic benchmark with a 180-record human check at Fleiss κ = 0.709, request-conditioned scoring improves high-risk retrieval on held-out indirect prompt injection, where static metadata cannot see the attack. On a frozen 500/100 scoring subset, STARS-LLM raises rules-only HR-AUPRC from 0.297 to 0.728 in-distribution and from 0.504 to 0.757 on held-out IPI. That gain is in ranking: under frozen thresholds, held-out classification accuracy does not improve. SIA-Bench is a ranking stress test, not an estimate of real-world prevalence.