skill-vetter

To scan AI agent skills for malicious code before installation, use a multi-scanner security gate that analyzes skill directories or URLs to detect vulnerabilities, prompt injection, and suspicious patterns.

Prompt injection detection for AI skills is a security mechanism that analyzes skill code and configurations to identify malicious prompts designed to manipulate agent behavior before the skill is installed.

Yes, you can check a skill URL for vulnerabilities and secrets without downloading it by passing the URL to the security scanner, which analyzes skill integrity and safety against predefined security checks.

The multi-scanner approach works with Aguara and Cisco's skill-scanner, integrating their analysis capabilities alongside secrets-scan and structure-check to provide comprehensive skill integrity verification.

Automated vulnerability scanning for AI agent skills is limited to predefined security checks and known suspicious patterns, meaning novel or highly obfuscated malware might not be detected during the vetting process.