skill-vetter

Agent skill malware detection uses a structured vetting workflow that validates metadata, analyzes permission scopes, scans for obfuscated content, and detects typosquatted names to prevent data exfiltration and command injection prior to installation.

Typosquat detection for agent skills identifies malicious packages with deceptively similar names to legitimate ones. It functions as a pre-install security check to block risky skills that mimic trusted metadata before they breach your environment.

You can audit installed agent skills by applying a periodic vetting protocol that performs permission scope analysis and red flag scanning. This generates standardized Safe, Warning, Danger, or Block risk verdicts with actionable recommendations.

Yes, you can review shared agent skill files for security risks without dependencies. The vetting process runs self-contained structural checks covering metadata validation and content scanning to identify malicious, risky, or typosquatted files.

The best way to prevent command injection from external agent skills is pre-install security vetting. A structured protocol scans for obfuscated content and analyzes permission scopes to generate clear risk verdicts before installation.