Scan repositories for malicious patterns and credential exposures using Sigil CLI.
npx skills add https://github.com/NOMARJ/sigil --skill scan-repo-nomarj
Please help me install this Agent Skill. Skill: scan-repo Source: https://github.com/NOMARJ/sigil/tree/main/plugins/claude-code/skills/scan-repo Command: npx skills add https://github.com/NOMARJ/sigil --skill scan-repo-nomarj
Prevents execution of malicious or unsafe code by scanning repositories and directories for install hooks, dynamic execution patterns, network exfiltration, and exposed credentials before they enter your working environment.
Run the Sigil scan on the target path and return the findings, risk score, and a recommended approve or reject action.
High-intent search queries and answers about installing and using this skill.
You can scan cloned repositories for malicious patterns by providing the target directory path to the Sigil CLI scanner. It detects install hooks, dynamic execution, network exfiltration, and credential exposures, returning a risk score and verdict.
Checking a downloaded AI agent skill for install hooks and credential exposure involves scanning the package directory for malicious patterns. The scanner identifies outbound HTTP activity, socket usage, eval/exec patterns, and exposed API keys with a recommended approve or reject action.
Repository risk scoring for code audits evaluates detected malicious patterns to generate a verdict of CLEAN, LOW, MEDIUM, HIGH, or CRITICAL. It surfaces findings with recommended approve or reject actions for CI pipelines, local audits, or agent skill review workflows.
Yes, you can audit a suspicious package for network exfiltration and DNS tunneling patterns without dependencies. The scanner requires only the target path to run and identifies outbound HTTP/webhook activity, socket usage, and dynamic imports deterministically.
You need to scan directories for malicious patterns before installing dependencies when reviewing cloned repositories, downloaded agent skills, or packages before they enter your development or production environment to prevent execution of unsafe code.
X-School-AcademyInitiates asynchronous SFTP downloads of remote files specified by SSH profile and paths.
wongdeanAudit npm, pip, and Go dependencies for vulnerabilities and malicious indicators.
icartshAnalyze .NET solutions for code quality, security, and dependency issues.
UseAI-proMonitor active OpenClaw skills for runtime security violations.
