# Agent Skill Security Scanner (`scraper_guru/agent-skill-security-scanner`) Actor

Scan Claude, Codex, Cursor, and skills.sh agent skills for prompt injection, secret access, unsafe commands, exfiltration, and supply-chain risks.

- **URL**: https://apify.com/scraper\_guru/agent-skill-security-scanner.md
- **Developed by:** [LIAICHI MUSTAPHA](https://apify.com/scraper_guru) (community)
- **Categories:** Developer tools, AI, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $30.00 / 1,000 skill scan results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Agent Skill Security Scanner

Scan Claude, Codex, Cursor, and skills.sh agent skills for prompt injection, credential access, unsafe commands, data exfiltration, persistence, MCP configuration risks, and supply-chain behavior.

The Actor performs **static analysis only**. It downloads text files into an isolated Actor run, parses them, and applies deterministic security rules. It never installs dependencies or executes submitted scripts.

### Features

- Scan public skills.sh pages and GitHub repositories
- Inspect direct `SKILL.md` files, raw content, and ZIP archives
- Detect instruction overrides and approval bypasses
- Flag destructive commands, privilege escalation, and persistence
- Identify credential-file and browser-session access
- Detect download-and-execute and potential exfiltration patterns
- Review package installation hooks, CI workflows, and MCP settings
- Produce a 0-100 risk score with file and line evidence
- Export dataset records plus HTML and JSON reports
- Fail CI runs when a skill requires review

### What You Can Scan

| Source | Example |
|---|---|
| skills.sh | `https://skills.sh/owner/repository/skill-name` |
| GitHub repository | `https://github.com/owner/repository` |
| GitHub folder or file | A public `/tree/` or `/blob/` URL |
| Direct file | A public raw `SKILL.md` URL |
| ZIP archive | A public URL returning a ZIP file |
| Raw content | Paste the complete `SKILL.md` into the input form |

Private GitHub repositories are not accepted through the input form. An operator can provide a narrowly scoped `GITHUB_TOKEN` through Apify environment secrets when private-source scanning is required.

### Use Cases

- Review a skill before installing it in Claude, Codex, Cursor, or another agent
- Add a security gate to an agent-skill registry
- Audit an internal library of reusable AI instructions
- Detect risky changes in scheduled GitHub repository scans
- Build trust reports for skill authors and marketplaces
- Inventory domains and permissions requested by third-party skills

### How to Use

1. Open the Actor input page.
2. Add one or more public source URLs, or paste raw `SKILL.md` content.
3. Select **Standard** scan depth for normal reviews.
4. Run the Actor.
5. Review the **Scan summaries** dataset view.
6. Open **Security findings** for exact evidence and remediation.
7. Download the HTML or JSON report from the run output.

The prefilled input scans a harmless local example and requires no external request, allowing a fast first run.

### Input

```json
{
  "sources": [
    "https://github.com/example/agent-skills"
  ],
  "scanDepth": "standard",
  "includeLowConfidence": false,
  "maxFiles": 500,
  "maxDownloadMbytes": 10,
  "failOnHighRisk": false
}
```

#### Scan Depth

| Mode | Files inspected | Best for |
|---|---|---|
| Quick | Skill metadata, manifests, setup scripts, workflows | Fast intake checks |
| Standard | Common source, configuration, scripts, and documentation | Normal security review |
| Deep | Every supported text file within limits | Release and incident audits |

### Output

Each skill produces one dataset item containing its summary and a nested `findings` array. The **Security findings** view expands that array into evidence-level rows.

```json
{
  "recordType": "summary",
  "skillName": "example-skill",
  "riskScore": 72,
  "riskLevel": "high",
  "verdict": "review-required",
  "filesScanned": 18,
  "findingCount": 6,
  "criticalFindings": 1,
  "highFindings": 2,
  "externalDomains": ["api.example.com"],
  "permissions": ["credential-read", "network-write"],
  "findings": [
    {
      "ruleId": "ASI-301",
      "severity": "critical",
      "filePath": "SKILL.md",
      "line": 27,
      "evidence": "curl ...",
      "remediation": "Remove the transmission or constrain it to approved fields."
    }
  ]
}
```

Finding objects include the rule identifier, category, severity, confidence, file path, line number, evidence, and remediation.

### Risk Model

The score combines the strongest match for each distinct rule:

| Severity | Base contribution |
|---|---:|
| Critical | 35 |
| High | 18 |
| Medium | 7 |
| Low | 2 |

Confidence adjusts the contribution, and the final score is capped at 100. A repeated low-level match does not inflate the score indefinitely.

| Score | Verdict |
|---:|---|
| 0-14 | Low risk |
| 15-39 | Caution |
| 40-79 | Review required |
| 80-100 | Block |

Static analysis cannot prove that a skill is safe. Review source provenance, high-impact permissions, and changes made after the scan.

### API

#### Python

```python
from apify_client import ApifyClient

client = ApifyClient("YOUR_APIFY_TOKEN")
run = client.actor("YOUR_USERNAME/agent-skill-security-scanner").call(run_input={
    "sources": ["https://github.com/example/agent-skill"],
    "scanDepth": "standard",
})

for record in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(record)
```

#### JavaScript

```javascript
import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: 'YOUR_APIFY_TOKEN' });
const run = await client.actor('YOUR_USERNAME/agent-skill-security-scanner').call({
    sources: ['https://github.com/example/agent-skill'],
    scanDepth: 'standard',
});

const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);
```

### Pricing

The initial private version uses Apify's pay-per-event configuration at `$0.005` per scanned-skill dataset item. Before a public launch, pricing should be converted to explicit standard-scan and deep-scan events.

Platform compute, storage, and data transfer may still depend on the user's Apify plan.

### Security Boundaries

- Submitted code is never executed.
- Package managers and install scripts are never invoked.
- Archive paths are validated before extraction.
- Private, loopback, and credential-bearing source URLs are rejected.
- Every redirect target is validated before it is requested.
- Binary files and generated dependency folders are skipped.
- Repository, file-count, and file-size limits are enforced.
- Token-like evidence is redacted before reports are saved.
- GitHub credentials are read only from the Actor's environment, never from dataset output.

### FAQ

#### Does a low-risk result mean the skill is safe?

No. It means the current deterministic rules found limited evidence of known risky patterns. Manual review is still necessary for sensitive environments.

#### Will the scanner install the skill?

No. It only downloads and parses supported text files.

#### Can it scan private GitHub repositories?

Yes, when the Actor operator supplies a narrowly scoped `GITHUB_TOKEN` through Apify environment secrets. Do not paste repository tokens into ordinary Actor input.

#### Why was ordinary documentation flagged for a URL?

Network references are informational low-severity findings. Review whether the domain is expected and whether the skill sends sensitive data.

#### Can I use it in CI?

Yes. Enable `failOnHighRisk` to save the complete report and then fail the run when a skill is blocked or requires review.

#### Does it use an AI model to decide the verdict?

No. The core result is deterministic and evidence-based. This avoids nondeterministic verdicts and keeps every finding traceable to a rule and source line.

# Actor input Schema

## `sources` (type: `array`):

Public skills.sh pages, GitHub repositories, GitHub files, raw SKILL.md URLs, or ZIP URLs.

## `rawSkill` (type: `string`):

Paste a SKILL.md document directly. This content is inspected as text and is never executed.

## `rawSkillName` (type: `string`):

Name used in reports for pasted SKILL.md content.

## `scanDepth` (type: `string`):

Quick scans manifests and executable setup files. Standard scans common source and configuration files. Deep scans every supported text file.

## `includeLowConfidence` (type: `boolean`):

Include experimental findings that may require more manual interpretation.

## `maxFiles` (type: `integer`):

Safety limit for files extracted from each repository or ZIP archive.

## `maxDownloadMbytes` (type: `integer`):

Maximum repository or ZIP download size in megabytes.

## `failOnHighRisk` (type: `boolean`):

Fail the run after saving reports when any skill is blocked or requires review. Useful in CI pipelines.

## Actor input object example

```json
{
  "sources": [],
  "rawSkill": "---\nname: safe-example\ndescription: Summarize a local Markdown document.\n---\n\n# Safe example\n\nRead the Markdown file selected by the user and return a concise summary. Do not modify files or contact external services.",
  "rawSkillName": "safe-example",
  "scanDepth": "standard",
  "includeLowConfidence": false,
  "maxFiles": 500,
  "maxDownloadMbytes": 10,
  "failOnHighRisk": false
}
```

# Actor output Schema

## `scanSummaries` (type: `string`):

Risk scores, verdicts, permissions, domains, and finding counts for each scanned skill.

## `securityFindings` (type: `string`):

Rule-level findings with severity, file, line, evidence, and remediation.

## `htmlReport` (type: `string`):

Human-readable report for review and sharing.

## `jsonReport` (type: `string`):

Complete machine-readable scan output.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "sources": [],
    "rawSkill": `---
name: safe-example
description: Summarize a local Markdown document.
---

# Safe example

Read the Markdown file selected by the user and return a concise summary. Do not modify files or contact external services.`,
    "rawSkillName": "safe-example"
};

// Run the Actor and wait for it to finish
const run = await client.actor("scraper_guru/agent-skill-security-scanner").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "sources": [],
    "rawSkill": """---
name: safe-example
description: Summarize a local Markdown document.
---

# Safe example

Read the Markdown file selected by the user and return a concise summary. Do not modify files or contact external services.""",
    "rawSkillName": "safe-example",
}

# Run the Actor and wait for it to finish
run = client.actor("scraper_guru/agent-skill-security-scanner").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "sources": [],
  "rawSkill": "---\\nname: safe-example\\ndescription: Summarize a local Markdown document.\\n---\\n\\n# Safe example\\n\\nRead the Markdown file selected by the user and return a concise summary. Do not modify files or contact external services.",
  "rawSkillName": "safe-example"
}' |
apify call scraper_guru/agent-skill-security-scanner --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,scraper_guru/agent-skill-security-scanner"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/yfu6mO3Dp5nm0HOL4/builds/bxNN5EUdOxqCalvTX/openapi.json