Agent Skill Security Scanner

Scan Claude, Codex, Cursor, and skills.sh agent skills for prompt injection, credential access, unsafe commands, data exfiltration, persistence, MCP configuration risks, and supply-chain behavior.

The Actor performs static analysis only. It downloads text files into an isolated Actor run, parses them, and applies deterministic security rules. It never installs dependencies or executes submitted scripts.

Features

• Scan public skills.sh pages and GitHub repositories
• Inspect direct SKILL.md files, raw content, and ZIP archives
• Detect instruction overrides and approval bypasses
• Flag destructive commands, privilege escalation, and persistence
• Identify credential-file and browser-session access
• Detect download-and-execute and potential exfiltration patterns
• Review package installation hooks, CI workflows, and MCP settings
• Produce a 0-100 risk score with file and line evidence
• Export dataset records plus HTML and JSON reports
• Fail CI runs when a skill requires review

What You Can Scan

Source	Example
skills.sh	https://skills.sh/owner/repository/skill-name
GitHub repository	https://github.com/owner/repository
GitHub folder or file	A public /tree/ or /blob/ URL
Direct file	A public raw SKILL.md URL
ZIP archive	A public URL returning a ZIP file
Raw content	Paste the complete SKILL.md into the input form

Private GitHub repositories are not accepted through the input form. An operator can provide a narrowly scoped GITHUB_TOKEN through Apify environment secrets when private-source scanning is required.

Use Cases

• Review a skill before installing it in Claude, Codex, Cursor, or another agent
• Add a security gate to an agent-skill registry
• Audit an internal library of reusable AI instructions
• Detect risky changes in scheduled GitHub repository scans
• Build trust reports for skill authors and marketplaces
• Inventory domains and permissions requested by third-party skills

How to Use

1. Open the Actor input page.
2. Add one or more public source URLs, or paste raw SKILL.md content.
3. Select Standard scan depth for normal reviews.
4. Run the Actor.
5. Review the Scan summaries dataset view.
6. Open Security findings for exact evidence and remediation.
7. Download the HTML or JSON report from the run output.

The prefilled input scans a harmless local example and requires no external request, allowing a fast first run.

Input

{
  "sources": [
    "https://github.com/example/agent-skills"
  ],
  "scanDepth": "standard",
  "includeLowConfidence": false,
  "maxFiles": 500,
  "maxDownloadMbytes": 10,
  "failOnHighRisk": false
}

Scan Depth

Mode	Files inspected	Best for
Quick	Skill metadata, manifests, setup scripts, workflows	Fast intake checks
Standard	Common source, configuration, scripts, and documentation	Normal security review
Deep	Every supported text file within limits	Release and incident audits

Output

Each skill produces one dataset item containing its summary and a nested findings array. The Security findings view expands that array into evidence-level rows.

{
  "recordType": "summary",
  "skillName": "example-skill",
  "riskScore": 72,
  "riskLevel": "high",
  "verdict": "review-required",
  "filesScanned": 18,
  "findingCount": 6,
  "criticalFindings": 1,
  "highFindings": 2,
  "externalDomains": ["api.example.com"],
  "permissions": ["credential-read", "network-write"],
  "findings": [
    {
      "ruleId": "ASI-301",
      "severity": "critical",
      "filePath": "SKILL.md",
      "line": 27,
      "evidence": "curl ...",
      "remediation": "Remove the transmission or constrain it to approved fields."
    }
  ]
}

Finding objects include the rule identifier, category, severity, confidence, file path, line number, evidence, and remediation.

Risk Model

The score combines the strongest match for each distinct rule:

Severity	Base contribution
Critical	35
High	18
Medium	7
Low	2

Confidence adjusts the contribution, and the final score is capped at 100. A repeated low-level match does not inflate the score indefinitely.

Score	Verdict
0-14	Low risk
15-39	Caution
40-79	Review required
80-100	Block

Static analysis cannot prove that a skill is safe. Review source provenance, high-impact permissions, and changes made after the scan.

API

Python

from apify_client import ApifyClient

client = ApifyClient("YOUR_APIFY_TOKEN")
run = client.actor("YOUR_USERNAME/agent-skill-security-scanner").call(run_input={
    "sources": ["https://github.com/example/agent-skill"],
    "scanDepth": "standard",
})

for record in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(record)

JavaScript

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: 'YOUR_APIFY_TOKEN' });
const run = await client.actor('YOUR_USERNAME/agent-skill-security-scanner').call({
    sources: ['https://github.com/example/agent-skill'],
    scanDepth: 'standard',
});

const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

Pricing

The initial private version uses Apify's pay-per-event configuration at $0.005 per scanned-skill dataset item. Before a public launch, pricing should be converted to explicit standard-scan and deep-scan events.

Platform compute, storage, and data transfer may still depend on the user's Apify plan.

Security Boundaries

• Submitted code is never executed.
• Package managers and install scripts are never invoked.
• Archive paths are validated before extraction.
• Private, loopback, and credential-bearing source URLs are rejected.
• Every redirect target is validated before it is requested.
• Binary files and generated dependency folders are skipped.
• Repository, file-count, and file-size limits are enforced.
• Token-like evidence is redacted before reports are saved.
• GitHub credentials are read only from the Actor's environment, never from dataset output.

FAQ

Does a low-risk result mean the skill is safe?

No. It means the current deterministic rules found limited evidence of known risky patterns. Manual review is still necessary for sensitive environments.

Will the scanner install the skill?

No. It only downloads and parses supported text files.

Can it scan private GitHub repositories?

Yes, when the Actor operator supplies a narrowly scoped GITHUB_TOKEN through Apify environment secrets. Do not paste repository tokens into ordinary Actor input.

Why was ordinary documentation flagged for a URL?

Network references are informational low-severity findings. Review whether the domain is expected and whether the skill sends sensitive data.

Can I use it in CI?

Yes. Enable failOnHighRisk to save the complete report and then fail the run when a skill is blocked or requires review.

Does it use an AI model to decide the verdict?

No. The core result is deterministic and evidence-based. This avoids nondeterministic verdicts and keeps every finding traceable to a rule and source line.