Is this Claude skill safe?

Scan it before you install it. The scanner reads the skill directory and reports what the code does: network calls, secrets, shell commands, and obfuscation. It never runs the skill, so the report itself is safe to produce. The verdict is yours, made on evidence.

How do I scan a Claude skill for malware?

Install the CLI and run agentscan scan on the skill directory — for example, agentscan scan ~/.claude/skills. The report lists shell commands, network calls, secrets, and obfuscation patterns with file:line evidence. It works offline and never uploads the skill.

What does AgentScan scan?

It checks directories of AI agent skills, MCP servers, and agent configs, then reports shell commands, network calls, secrets, licenses, dependencies, and obfuscation.

Does AgentScan run my skills?

No. The scanner never runs a skill. It reads files and reports the patterns it observes, so the same input always gives the same report.

Does AgentScan send my data anywhere?

No. Everything runs locally and offline. The only optional network call is an OSV vulnerability lookup, which is off by default.

How much does Trust Pack cost?

Trust Pack is a $59 one-time purchase. It grants a license key that activates the 90-skill, 15-agent professional bundle for Claude Code, OpenCode, Codex, Hermes, and Grok Build. There are no subscriptions.

Why is AgentScan one-time instead of a subscription?

A subscription sells continuous service. AgentScan has no server to run and no account to bill. The scanner is local, free, and open source. Trust Pack is a pack of files you own, with twelve months of included updates.

How is AgentScan different from a platform scanner?

Platform scanners run in the cloud, need an account, and sell per-seat contracts. AgentScan runs locally, needs no account, and sells a one-time pack. It never executes a skill and never uploads your code.

Open source · Local · Deterministic

Trust is decided before install.

Skills run with your permissions. AgentScan reads a skill before you install it and shows you what it does: shell commands, network calls, secrets, license, with the exact line for each. It runs nothing. It sends nothing.

Paste a skill · scan free Get the CLI

$ pipx install agentscan-cli|zero dependencies|works offline|scans before install

01 — The two layers

The AI security stack has two layers. Only one decides trust.

Scanning happens before install. Runtime tools act after. A skill that ran was trusted at install time.

01 — Scanning

before install

Trust is decided here.

A scan reads the skill. It runs nothing. The verdict is yours, and it comes before anything executes.

This is where AgentScan lives.

02 — Runtime

after install

Once it runs, the damage is done.

Monitoring, alerting, and rollback happen after a skill has already acted. By then, the damage may already be done.

Runtime tools react after the fact.

Trust is decided before install.

Works with your favorite AI coding agents

Claude Code
OpenAI Codex
OpenCode
Hermes
Grok Build

Install

$ pipx install agentscan-cli

$ agentscan scan .

Scan a skill directory for malware, secrets, and network calls. Local and offline.

$ agentscan search

Browse the catalog.

$ agentscan install trust-pack

Install Trust Pack. Runtimes auto-detected.

$ agentscan install trust-pack --runtime hermes

Pick a runtime: claude, codex, opencode, hermes, grok.

$ agentscan install trust-pack --runtime grok

Grok Build installs to ~/.grok/skills/.

$ agentscan update

Update installed packages.

$ agentscan verify

Check installed packages.

02 — Pricing

The scanner is free. Trust Pack is one-time.

The scanner is free and open source. Trust Pack is a one-time purchase. No subscription.

Free

AgentScan CLI

Open-source security scanner for AI agent skills.

Freeforever

Unlimited local scans
Scan GitHub repositories
Scan local skill directories
Human-readable reports
JSON output
MIT licensed
Local-first
No account required
No telemetry
Community support

Get Started

MIT · Open Source · Local First

Trust Pack

The professional skill bundle

Ninety audited skills and fifteen specialist agents across eight engineering domains. Signed releases. Deterministic builds. One command to install.

$59one-time purchase

90 audited skills
15 specialist agents
Eight engineering domains
Human-reviewed skills
Deterministic builds
Signed releases
Public audit reports
SHA256 verification
Commercial use
One-command installation
12 months of package updates
Priority email support

Get Trust Pack

includes 12 months of updates

Pricing, roadmap and FAQ

03 — The problem

Agent skills are dependencies now.

A skill is code. Your agent runs it with your permissions and your secrets. Installing a skill from a random repository is curl|bash with extra steps. Nobody reviews it first.

Installed like a plugin. Runs like software.

A skill reads your files. It reaches your network. It runs in your shell. Nobody reviews it before it does.

Marketplaces rank by stars.

Stars mean people installed it. They do not mean it is safe.

The incidents are already here.

ToxicSkills (Snyk, Feb 2026): 76 confirmed malicious payloads in 3,984 public skills. Clinejection turned one issue title into a supply-chain compromise.

04 — The record

The problem is measured. The sources are public.

Independent audits and mainstream coverage agree. Each number and claim below carries its source, so you can check it.

13.4%

of public agent skills have critical security issues

Snyk ToxicSkills, 3,984 skills

93.6%

declare no recognizable license

AgentScan corpus, 4,000 skills

confirmed malicious payloads in the audit

Snyk ToxicSkills

were still live at publication

Snyk ToxicSkills

The category is real

Snyk — Feb 2026

ToxicSkills scanned 3,984 public agent skills. 13.4% had critical issues. 76 were confirmed malicious. 8 were still live at publication.

read ↗

CNN — Jul 2026

OpenAI test models escaped a sandbox without human direction and hacked onto another company's servers.

read ↗

GitHub — Mar 2026

Secret scanning now covers code written by AI coding agents, via the GitHub MCP server.

read ↗

Anthropic — Apr 2026

Project Glasswing: Anthropic and leading security vendors publicly treat AI-agent code as a security surface.

read ↗

05 — The scanner

Point it at any skill.

It runs locally. It executes nothing. It never calls out. Same input gives the same report.

$ agentscan .agentscan 0.5.0 — .scanned 1 artifact(s), 2 finding(s)  ARTIFACT  [claude-skill] deploy-notifier — Notifies a channel when a deploy finishes.  LOW      [license] No license declared           SKILL.md:1           Skill declares no license (frontmatter `license:` or LICENSE file). Redistribution rights unclear.  INFO     [network] URL in skill           SKILL.md:16           https://api.example.com/v1/notify  summary: critical=0 high=0 medium=0 low=1 info=1  note: findings are observed patterns, not verdicts. Review each before acting.$ echo $?0

Risk summary

Severity counts for each check. Use them to make a verdict.

Warnings

Findings with file and line. Shell, eval, unpinned installs, hooks.

Dangerous permissions

rm -rf, chmod 777, force-push, remote MCP servers.

Network access

Where the skill connects. URLs, IP literals, exfil sinks.

License

Declared vs recognized. Most public skills declare no license.

Secrets

20+ token formats. Placeholders excluded by design.

06 — Trust Pack

One pack. Ninety skills. Fifteen agents. Every one audited.

Every skill is scanned and reviewed. We re-verify it on every release. We keep the list small on purpose.

Human review

A person reads every listing. The review leaves a public record.

Continuous verification

Every release is re-scanned. Behavior changes show up before you update.

Signed releases

A tampered archive fails verification and does not install.

Public audit history

Every scan report, review note, and re-verification is public.

See pricing

one-time purchase · updates for 12 months

07 — Integrations

The scanner is also a GitHub Action, a pre-commit hook, and an MCP server.

All three are in the repo today. All three work offline.

GitHub Action

Scan every push. Fail the merge.

A ready workflow installs the CLI, scans skills, and uploads SARIF to code scanning. Copy one file into your repo.

.github/workflows/scan-skills.yml↗

Pre-commit

Block the commit on findings.

A pre-commit hook runs the scan before you commit. Findings at your threshold stop the commit.

.pre-commit-hooks.yaml↗

MCP server

Scan from any MCP client.

A stdio MCP server exposes the scanner as a tool. Claude, Cursor, or any agent can scan a directory on demand.

agentscan-mcp↗

Machine output: JSON · SARIF 2.1.0 · SBOM (CycloneDX) · OSV (opt-in) · Exit codes for CI

08 — Features

A small tool with one job.

Each command does one thing.

Local scanning

Point it at a directory. It scans skills, MCP servers, and configs.

Zero cloud upload

No account. No telemetry. It works offline.

Open source CLI

MIT license. Zero dependencies. Standard library only.

Deterministic, not ML

It uses regex, entropy, and structure. Same input gives the same report.

Executes nothing

It never runs the skill. It never makes a network call.

CI-ready output

Exit codes, JSON, and SARIF 2.1.0 for GitHub code scanning.

Scan before you install.

It is free, local, and open source. It takes one command.

Scan a skill Get the CLI

$ pipx install agentscan-cli