Question 1

Is this Claude skill safe?

Accepted Answer

Scan it before you install it. The scanner reads the skill directory and reports what the code does: network calls, secrets, shell commands, and obfuscation. It never runs the skill, so the report itself is safe to produce. The verdict is yours, made on evidence.

Question 2

How do I scan a Claude skill for malware?

Accepted Answer

Install the CLI and run agentscan scan on the skill directory — for example, agentscan scan ~/.claude/skills. The report lists shell commands, network calls, secrets, and obfuscation patterns with file:line evidence. It works offline and never uploads the skill.

Question 3

What does AgentScan scan?

Accepted Answer

It checks directories of AI agent skills, MCP servers, and agent configs, then reports shell commands, network calls, secrets, licenses, dependencies, and obfuscation.

Question 4

Does AgentScan run my skills?

Accepted Answer

No. The scanner never runs a skill. It reads files and reports the patterns it observes, so the same input always gives the same report.

Question 5

Does AgentScan send my data anywhere?

Accepted Answer

No. Everything runs locally and offline. The only optional network call is an OSV vulnerability lookup, which is off by default.

Question 6

How much does Trust Pack cost?

Accepted Answer

Trust Pack is a $59 one-time purchase. It grants a license key that activates the 90-skill, 15-agent professional bundle for Claude Code, OpenCode, Codex, Hermes, and Grok Build. There are no subscriptions.

Agent skill security, in plain terms.

How to audit an AI agent skill before you install it