skill-scanner

To scan AI agent skills for prompt injection and credential exposure, run a static analysis check on SKILL.md metadata and linked scripts. This identifies security risks by enforcing pattern-based checks and outputs a structured JSON report with a human-readable summary for risk assessment.

Yes, you can automate static analysis checks for supply-chain risks in your CI/CD pipeline. The scanner enforces pattern-based checks during gated checks and audits, outputting a structured JSON report that supports CI/CD gating and continuous security monitoring across skill libraries.

The best way to audit a local directory of AI skills for malicious execution risks is to run an automated scanner across the repository downloads. It applies static pattern-based checks to SKILL.md files and scripts, generating a structured JSON report and human-readable summary to support audit trails.

Yes, the skill scanner detects data exfiltration and malicious payloads in SKILL.md files. It scans front matter and linked scripts to identify these specific threats using static pattern-based checks, providing a structured JSON report to support risk assessment before skill onboarding.

To review AI skill libraries for security threats during a PR review, scan the SKILL.md metadata and related resources. The scanner enforces static checks for prompt injection and malicious execution, producing a human-readable summary and structured JSON report to support safe skill onboarding.

The limitations of static pattern-based checks for AI skill security include relying on predefined patterns to detect prompt injection and credential exposure. This approach identifies known threat signatures in SKILL.md files and scripts but may not catch novel or obfuscated zero-day vulnerabilities during skill review.