skill-scanner

Static analysis of agent skills detects prompt injections, secret leaks, and malicious scripts by evaluating code patterns and permissions. This prevents risky code from executing and ensures safety before integration into a team environment.

To scan a skill directory for malicious code, run the scanner script with the directory path as the argument. The tool performs pattern matching, script review, and URL trust assessment to identify potential vulnerabilities.

Static code analysis detects prompt injection points by applying pattern matching and script review to the skill's code. It assesses URL trust and permissions to determine safety levels for skill adoption.

Yes, pyyaml is required to run a security review on agent configurations. The scanner relies on this dependency to parse configuration files and perform pattern matching to identify hidden vulnerabilities.

Assessing URL trust and permissions for agent skill compliance involves behavioral security analysis that evaluates requested access levels. This determines safety by checking configurations against best security practices before deployment.