skills.rest
NOMARJ
NOMARJOFFICIAL
Explore all skills by this author →
WebsiteGitHub

sigil-scan

Detect malicious patterns in repositories, packages, MCP servers, and AI skills.

5|2|Updated Feb 15, 2026
Search Tags:#security#mcp#supply-chain#scan#code-audit#malware-detection#sigil
One-click install
npx skills add https://github.com/NOMARJ/sigil --skill sigil-scan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sigil-scan
Source: https://github.com/NOMARJ/sigil/tree/main/sigil-skill/sigil-scan
Command: npx skills add https://github.com/NOMARJ/sigil --skill sigil-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires sigil, curl, wget, jq, python3, sha256sum, shasum, timeout, gtimeout, brew, npm, cargo, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Sigil-scan prevents unreviewed or malicious AI agent code and supply-chain threats from executing by analyzing repositories, packages, MCP servers, and installed skills before they are used.

Core Features & Use Cases

  • Eight-phase analysis: Install hooks, dangerous code patterns, network exfiltration, credential access, obfuscation, provenance, prompt injection, and skill security.
  • Local, JSON-first scanning: Produces a unified JSON verdict with phased findings, scores, rule IDs, file paths, and contextual snippets suitable for automated workflows.
  • Use Case: Audit a GitHub repository, npm/pip package, or installed skill before cloning or installing to detect postinstall hooks, hardcoded keys, exfiltration endpoints, and prompt-jailbreak attempts.

Quick Start

Run the sigil-scan skill to audit the target repository or package and return a unified JSON verdict with findings and a risk score.

Frequently Asked Questions about sigil-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan an npm package for malware before installing it?▼

Scanning an npm package for malware involves running an eight-phase audit that detects postinstall hooks, hardcoded keys, and exfiltration endpoints, returning a unified JSON verdict with risk scores and detailed evidence.

What is supply-chain security for AI agent code?▼

Supply-chain security for AI agent code analyzes repositories, packages, MCP servers, and installed skills to detect malicious patterns, prompt injection, and credential exfiltration before code execution occurs.

How do I detect prompt injection attacks in cloned GitHub repositories?▼

Detect prompt injection in GitHub repositories by running a local code audit that applies phased analysis to identify prompt-jailbreak attempts, producing a JSON verdict with rule IDs, file paths, and contextual snippets.

Does sigil-scan work without internet access for local code audits?▼

Local code audits work offline after the initial setup phase, requiring only the Sigil CLI to scan local paths and installed agent skills for dangerous code patterns and network exfiltration risks.

What's the best way to audit MCP servers for dangerous code patterns?▼

Auditing MCP servers for dangerous code patterns requires a multi-phase security scan that checks for install hooks, obfuscation, and provenance issues, yielding a scored JSON verdict with detailed rule-level evidence.

What dependencies do I need to run a local supply-chain scan?▼

Running a local supply-chain scan requires the Sigil CLI alongside standard tools like curl, wget, jq, python3, sha256sum, and package managers such as npm, cargo, and brew for initial environment setup.

Related Skills

Explore More Software Engineering Skills→
iliagermaniliagerman
1

dependency_installer

Install software packages and dependencies at runtime using multiple package managers.

Community
Intermediate
thimsluggathimslugga

performance-profiling

Run automated Lighthouse audits to measure web app performance, accessibility, and SEO.

Community
Intermediate
cafe3310cafe3310
248

cafe3310-skill-installer

Clone a GitHub repository and synchronize Agent Skills into local directories.

Community
Intermediate
vertivolatamvertivolatam
1

Static Analysis

Run static analysis across multiple programming languages with linters and security scanners.

Official
Advanced