Skill Scanner
A best-effort security scanner for AI Agent Skills that looks for prompt injection, data exfiltration and malicious code patterns using pattern matching, AST and dataflow analysis, an optional LLM-as-judge step, and a rules layer, with CI and pre-commit integration.
Skill Scanner checks AI Agent Skills for security problems before they are used. It combines YAML- and YARA-X-based pattern detection, AST and dataflow analysis, an optional LLM-as-a-judge step, and a bounded CEL decision layer that correlates the typed facts produced by the other detectors into a final finding. It supports the OpenAI Codex Skills and Cursor Agent Skills formats, and, with a lenient mode, non-standard formats such as Claude Code command markdown files.
It integrates into a development workflow through a pre-commit hook, a reusable GitHub Actions workflow, SARIF output for GitHub code scanning, and exit codes that can fail a build. An optional meta-analyzer correlates and prioritizes findings, and a plugin architecture supports custom analyzers.
The project describes its own coverage as best-effort and incomplete: a scan with no findings does not certify that a skill is secure, and no automated tool can catch every technique, especially novel ones.