skill-scanner

Automated security scanning for agent skills before installation, detecting prompt injection, malicious code, excessive permissions, and supply chain risks. Scan agent skills for security issues before adoption. Detects prompt injection, malicious code, excessive permissions, secret exposure, and supply chain risks. Requires : The uv CLI for python package management, install guide at Important : Run all scripts from the repository root using the full path via ${CLAUDE_SKILL_ROOT} . Static analysis scanner that detects deterministic patterns. Outputs structured JSON. Returns JSON with findings, URLs, structure info, and severity counts. The script catches patterns mechanically — your job is to evaluate intent and filter false positives.