skills.rest
viniciuscs84
viniciuscs84COMMUNITY
Explore all skills by this author →
Website𝕏@viniciuscs84GitHub

sigil-scan

Scans repositories, packages, MCP servers, and skills for malicious code patterns and security risks.

Updated May 22, 2026
Search Tags:#security audit#prompt injection#malware detection#supply chain security#code scanning#credential leak#mcp security
One-click install
npx skills add https://github.com/viniciuscs84/sdd-toolkit --skill sigil-scan-viniciuscs84
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sigil-scan
Source: https://github.com/viniciuscs84/sdd-toolkit/tree/main/skills/sigil-scan
Command: npx skills add https://github.com/viniciuscs84/sdd-toolkit --skill sigil-scan-viniciuscs84

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires sigil-cli, jq, python3, and includes scripts (resource) and references (resource) components.

What problem does it solve? AI agents routinely clone repositories, install packages, and load skills without verifying their safety, exposing developers to supply chain attacks, credential theft, and prompt injection. This Skill audits any target before execution and returns a weighted risk verdict with detailed findings. ## Core Features & Use Cases - Eight-Phase Security Analysis: Detects install hooks, dangerous code patterns, network exfiltration, credential access, obfuscation, provenance issues, prompt injection, and skill security threats across 125 detection rules. - Multi-Target Scanning: Accepts local paths, GitHub URLs or shorthand, npm packages, pip packages, and arbitrary URLs, returning a unified JSON verdict with score and per-phase findings. - Environment and Skills Audits: Scans local .env files, credential file permissions, and shell history for leaked secrets, and audits all installed skills across agent directories like ~/.claude/skills and ~/.cursor/skills. - Use Case: Before running npm install on an unfamiliar package, ask the agent to scan it; if a critical postinstall hook is detected, the Skill flags it as CRITICAL RISK and blocks installation until you explicitly approve. ## Quick Start Ask the agent to scan a target before using it, for example: scan the GitHub repository owner/repo and tell me if it is safe to install.

Frequently Asked Questions about sigil-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a GitHub repository for malware before cloning it?▼

Run the scan script with the repository URL or owner/repo shorthand, for example bash scripts/scan.sh owner/repo. The Skill clones and analyzes the target, returning a JSON verdict with a risk score and detailed findings grouped by detection phase.

How do I check if an npm or pip package is safe to install?▼

Pass the package name to the scan script using npm:package-name or pip:package-name prefixes, or just the package name directly. The scanner detects install hooks like postinstall scripts, dangerous code patterns, and exfiltration behavior, then assigns a LOW to CRITICAL risk verdict.

What does the risk score and verdict mean in scan results?▼

Scores combine severity base values (Low 1 to Critical 5) multiplied by phase weights (up to 10x for install hooks and prompt injection). Verdicts are LOW RISK (0-9), MEDIUM RISK (10-24), HIGH RISK (25-49), and CRITICAL RISK (50+), with critical install hooks triggering immediate escalation.

Does the security scanner work offline on macOS and Linux?▼

Yes, all scanning runs locally and offline after the one-time CLI installation. It supports macOS (arm64/x64), Linux (x64), and WSL, with installation available via GitHub release, Homebrew, npm, or cargo.

Why does the scan report findings in my test files or documentation?▼

Test fixtures with intentionally malicious patterns and documentation showing dangerous code examples are common false positives. Review each finding's file path and line number in context to determine whether the pattern is legitimate or suspicious.

Can I audit all installed AI agent skills at once?▼

Yes, run bash scripts/audit-skills.sh to scan skills across agent directories including ~/.claude/skills, ~/.cursor/skills, ~/.codex/skills, and others. It returns a summary table with each skill's verdict, score, and top findings, with a 30-second timeout per skill.

Related Skills

Explore More Software Engineering Skills→
NOMARJNOMARJ
5

sigil-scan

Detect malicious patterns in repositories, packages, MCP servers, and AI skills.

Official
Advanced
AradotsoAradotso
11

slowmist-agent-security-framework

Review AI skill installations and external inputs for security threats.

Official
Advanced
GoldenWing-360GoldenWing-360
15

mcp-security

Analyze MCP server configurations for security vulnerabilities and secret exposure.

Official
Advanced
xalgordxalgord
954

performing-automated-malware-analysis-with-cape

Automates malware analysis using the CAPEv2 sandbox API for behavioral monitoring and config extraction.

Community
Intermediate