skill-scanner

Scans agent skills for security issues before they are adopted, detecting prompt injection, malicious scripts, excessive permissions, secret exposure, and supply chain risks. It combines a bundled static analysis scanner with an agent-driven review: the script catches deterministic patterns mechanically and emits structured JSON, while the agent evaluates intent, filters false positives, and reasons about behavior the scanner cannot see. The uv CLI is required for Python package management, and scripts such as scripts/scan_skill.py are run from the skill's own root directory rather than the target repository.

The workflow runs through several phases. Input and discovery locates the target, looking under .agents/skills/<name>/ and other established skill roots, validates that a SKILL.md exists, and supports scanning all skills by discovering every */SKILL.md. The automated static scan runs scripts/scan_skill.py to produce findings with severity levels, URL analysis, and structure information, with a manual Grep fallback if the script fails. Frontmatter validation checks for required name and description fields, name-to-directory consistency, allowed-tools justification, model overrides, and description accuracy.

Deeper phases focus on judgment. Prompt injection analysis distinguishes patterns that perform injection from those that merely discuss or detect it, since security and educational skills legitimately reference such patterns. Behavioral analysis is agent-only: it checks description-versus-instruction alignment, config and memory poisoning (edits to CLAUDE.md, settings.json, .mcp.json, hooks, or allowlists that persist after removal), scope creep, unnecessary information gathering, and structural attacks like symlinks escaping the skill directory, frontmatter hooks, backtick command syntax at load time, auto-discovered test files, npm postinstall hooks, and hidden instructions in image metadata. Script analysis reads every bundled script fully and inspects PEP 723 dependencies for exfiltration, reverse shells, credential theft, and dangerous execution. Supply chain assessment weighs trusted versus untrusted domains and remote instruction loading, and permission analysis applies a least-privilege tier system. Findings are reported with HIGH or MEDIUM confidence levels tied to confirmed patterns and evident intent.