How to use AgentScan.

00 — Overview

Two parts, one tool.

AgentScan has two parts. The scanner is free, local, and open source. It reads a directory of agent skills and reports what the code does: shell commands, network calls, secrets, licenses, dependencies, and obfuscation.

Trust Pack is the paid bundle: ninety audited skills across eight engineering domains — security, backend, frontend, devops, AI engineering, documentation, research, and developer marketing. You buy it once, activate a license key, and install with one command. No account, no dashboard, no login.

The scanner is deterministic. The same input gives the same report, every time. There is no model and no hallucination. A scan of 4,000 public skills found that 93.6% declare no license and 18% have a high or critical finding.

01 — Quickstart

Five commands.

Install the CLI, scan your first directory, activate, and install a package. The first three commands are free.

$ pipx install agentscan-cli$ agentscan scan ~/.claude/skills$ agentscan activate  # paste your license key when prompted$ agentscan search$ agentscan install trust-pack

02 — Install

One command, zero dependencies.

AgentScan requires Python 3.8 or newer. On Linux, install with pipx — it keeps the CLI in its own environment and avoids the system-python restrictions that block plain pip on modern distributions.

$ pipx install agentscan-cli

On macOS and Windows, plain pip works the same way.

$ pip install agentscan-cli

• The CLI has no dependencies. It works offline.
• The scanner is open source. The code is on GitHub under the MIT license.
• To upgrade later: pipx upgrade agentscan-cli or pip install -U agentscan-cli.

03 — Scan a directory

Point the scanner at anything.

The scanner accepts any directory of agent skills, MCP servers, or agent configs. It detects the artifact type for you. Run it on a skill you downloaded before you install it — a Claude Code skill, a Codex skill, or an MCP server. The report tells you what the code does; the verdict is yours.

$ agentscan scan ~/Downloads/unknown-skill$ agentscan scan . --severity high  # only high and critical findings fail the scan$ agentscan scan ~/.claude/skills  # exit 0: no findings at or above the threshold

Exit codes.

• 0 — no findings at or above the threshold.
• 1 — findings at or above the threshold.
• 2 — usage error or scan error.

The default threshold is medium. Findings below the threshold still print, but they do not fail the scan. Use --severity high to fail only on high and critical findings.

Machine-readable output.

Use the scanaskill binary for CI and code-scanning tools. It is the same scanner, with the same rules.

$ scanaskill ~/skills --json  # machine-readable report$ scanaskill ~/skills --sarif  # SARIF 2.1.0, GitHub code-scanning compatible$ scanaskill ~/skills --sbom  # CycloneDX 1.5 SBOM of extracted dependencies$ scanaskill ~/skills --osv  # OSV vulnerability lookup (online, opt-in)

The scanner detects these artifact types: claude-skill, mcp-server, cursor-rules, context-file, github-actions, npm-package, and generic.

04 — Read a report

Facts, not verdicts.

The scanner reports facts. It never says a skill is malicious. That verdict is yours. Every finding is an observed pattern with evidence you can check.

• Severity — the impact if the finding is true.
• Confidence — how likely the finding is true. It is separate from severity.
• Evidence — the file:line and snippet for every claim.
• Capability — what the artifact can do, with evidence.
• Review queue — low-confidence signals that need a human look. They are review items, never verdicts.

agentscan 1.1.0 — /home/you/Downloads/suspicious-skillscanned 1 artifact(s), 8 finding(s)  ARTIFACT  [claude-skill] auto-updater  CRITICAL [exfil] Local secret read piped to network           SKILL.md:41  CRITICAL [analysis] Secret data flows to external endpoint           SKILL.md:17           attack path: reads sensitive file (open.read)           -> urllib.request.urlopen receives tainted data (...)  summary: critical=3 high=2 medium=5 low=2 info=2  capabilities:    secret.access      SKILL.md:24    network.upload     SKILL.md:41  review queue (manual review — never a verdict):    HIGH [prompt_patterns] Instruction directs transfer of         credential material — SKILL.md:30

Attack paths show each hop of a tainted data flow, with citations per hop. Fingerprints are stable per rule and location, so you can compare reports over time.

05 — Buy and activate

One purchase, one key.

Trust Pack costs $49 once. Buy it on the pricing page. Polar processes the payment. You do not create an account.

After payment, Polar emails your license key. The key is also on your Polar purchases page, at any time, for any machine.

$ agentscan activate  License key: ••••••••••-E304DA  ✓ license valid  ✓ stored in ~/.agentscan/license

The CLI validates the key with Polar on every activation. A revoked, disabled, or expired key stops working. The scanner itself stays free.

06 — Install packages

Browse, install, done.

Browse the catalog with agentscan search. Install Trust Pack with agentscan install trust-pack. Install requires an active license.

$ agentscan search$ agentscan install trust-pack$ agentscan install "Trust Pack"$ agentscan install trust --runtime codex$ agentscan install trustpac  # typo -> the CLI suggests the right name

Runtimes.

The CLI detects the agent runtimes on your machine and installs into all of them. Pick one explicitly with --runtime, or use --runtime all.

Hermes honors $HERMES_HOME. Grok Build honors $GROK_HOME. Codex installs also add an AGENTS.md section to your repository root, marked with a comment. Reinstalls replace that section only.

Flexible names.

The package name matches flexibly. trust-pack, "Trust Pack", and trust all resolve. A typo gets a suggestion, not a silent failure.

07 — Update and verify

Keep packages current.

agentscan update upgrades installed packages, like brew upgrade. agentscan verify checks signature, latest version, audit, and integrity.

$ agentscan update  # like brew upgrade$ agentscan verify  # signature, latest, audit, intact$ agentscan whoami$ agentscan logout  # removes the license from this machine only

agentscan logout removes the license from this machine only. The license stays valid. Reinstall anywhere with the same key.

08 — Where things live

One folder.

AgentScan keeps its state in ~/.agentscan/. Remove it to reset the CLI on this machine.

09 — FAQ

Questions.