Question 1

Is this Claude skill safe?

Accepted Answer

Scan it before you install it. The scanner reads the skill directory and reports what the code does: network calls, secrets, shell commands, and obfuscation. It never runs the skill, so the report itself is safe to produce. The verdict is yours, made on evidence.

Question 2

How do I scan a Claude skill for malware?

Accepted Answer

Install the CLI and run agentscan scan on the skill directory — for example, agentscan scan ~/.claude/skills. The report lists shell commands, network calls, secrets, and obfuscation patterns with file:line evidence. It works offline and never uploads the skill.

Question 3

What does AgentScan scan?

Accepted Answer

It checks directories of AI agent skills, MCP servers, and agent configs, then reports shell commands, network calls, secrets, licenses, dependencies, and obfuscation.

Question 4

Does AgentScan run my skills?

Accepted Answer

No. The scanner never runs a skill. It reads files and reports the patterns it observes, so the same input always gives the same report.

Question 5

Does AgentScan send my data anywhere?

Accepted Answer

No. Everything runs locally and offline. The only optional network call is an OSV vulnerability lookup, which is off by default.

Question 6

How much does Trust Pack cost?

Accepted Answer

Trust Pack is a $59 one-time purchase. It grants a license key that activates the 90-skill, 15-agent professional bundle for Claude Code, OpenCode, Codex, Hermes, and Grok Build. There are no subscriptions.

Question 7

Why is AgentScan one-time instead of a subscription?

Accepted Answer

A subscription sells continuous service. AgentScan has no server to run and no account to bill. The scanner is local, free, and open source. Trust Pack is a pack of files you own, with twelve months of included updates.

Question 8

How is AgentScan different from a platform scanner?

Accepted Answer

Platform scanners run in the cloud, need an account, and sell per-seat contracts. AgentScan runs locally, needs no account, and sells a one-time pack. It never executes a skill and never uploads your code.

Agent skill security, in plain terms.

AI agent skills and compliance: what HIPAA and SOC 2 audits will ask

How to audit an AI agent skill before you install it