How to audit an AI agent skill before you install it.

Agent skills are the new supply chain, and nobody checks the boxes. Snyk's ToxicSkills audit scanned 3,984 public agent skills and found 13.4% with critical security issues. Eight were confirmed malicious and publicly available at the time. 36% contained prompt injection.

A skill is a folder. It holds a SKILL.md file that tells the agent how to behave, plus scripts the agent can run with your permissions. When you install a skill, you are giving instructions to a program that has access to your files, your shell, and your network.

The marketplace description is not a security review. You can audit a skill yourself in three steps, locally, in about two minutes.

Step 1: install the scanner

$ pipx install agentscan-cli$ agentscan scan ~/.claude/skills$ agentscan scan https://github.com/someone/some-skill

The scanner is MIT licensed, runs offline, and sends nothing anywhere. No account, no telemetry.

Step 2: scan a skill directory

Point it at the folder where your agent keeps its skills, or at a GitHub repository. The scan is local.

Step 3: read the findings

scanned 1 artifact(s), 12 finding(s)  HIGH   [filesystem] destructive disk operation         SKILL.md:142  MEDIUM [prompt_patterns] Always-run directive  LOW    [license] No license declared  summary: critical=0 high=1 medium=2 low=2 info=7  note: findings are observed patterns, not verdicts.        Review each before acting.

The scanner reports facts: shell commands, network calls, secrets, licenses, obfuscation, and the exact line for each finding. It never runs the skill. It never uploads the skill.

The output is deterministic. Same input, same result, every time. There is no LLM in the scan path, because a nondeterministic scanner is not a security tool. You cannot reproduce its verdict.

When the scanner sees the word "eval" in prose, it reports an info-level observation. It does not call your skill malicious. That call is yours to make, and the finding gives you the line to judge.

What the checks mean

• Destructive disk operation. The skill references commands like rm, dd, or mkfs. High severity means it deserves a human look before you install.
• Always-run directive. The skill tells the agent to execute something without asking first. This is how a bad skill gets its payload running.
• No license declared. 93.6% of public skills declare no license, per the corpus audit. Redistribution rights are unclear for almost the entire ecosystem. That is the compounding problem, more than any single malicious file.
• Secrets. Placeholder keys are normal. A real key in a skill is a leak waiting to happen.

What it does not catch

Honest limits. The scanner does not scan MCP servers yet. Obfuscated code can still beat static analysis. It shrinks the problem; it does not remove it. A skill you plan to run with full permissions deserves more than a single pass.

The rule of thumb

Scan everything you install, especially free skills from marketplaces and GitHub. A skill that wants to run code on your machine gets the same review you would give a pull request.

If you would rather install than review, the Trusted Distribution ships pre-audited skill packages: 90 skills, 15 agents, one-time $59, with public audit reports and deterministic builds. Every package passes a 10-check audit with zero high findings.

The scanner is free and open source: github.com/thesfb/agentscan.

What do you check before you install a skill? I want to know what the audit is missing.