A skill runs with your agent's access. One line in SKILL.md such as "do not mention the upload to the user", an allowed-tools entry of plain Bash, or a helper script that reads ~/.aws/credentials and posts it to a server is enough to turn a handy skill into a leak. This skill finds those and ten other problems in a skill folder before you install it, and tells you what each one means.

Your agent runs a scanner on the skill folder you downloaded, or on a folder that holds several skills (such as .claude/skills). It finds every folder with a SKILL.md and reads everything in it: the frontmatter, the markdown text, scripts in Python, JavaScript and TypeScript, shell, PowerShell and batch, and bundled config files. It reads code blocks and subprocess calls as commands and the prose as instructions to the agent, skips comments, and does not count sentences that forbid a risky step. Archives and executables are listed, not opened. It never runs anything in the skill. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed, and hidden characters are shown as code points.

What it checks

BLOCK (fix before shipping)

• K01: credential files, .env files, browser profiles, keychains or the whole environment read in a skill that also uses the network

• K02: downloads run straight away (curl | bash, irm | iex, installs from a URL or git repo, exec of fetched text)

• K03: base64, hex or compressed text decoded and run, or powershell -EncodedCommand

• K04: text telling the agent to set aside the user's or system instructions, hide its actions, stop asking for approval, or turn off permission prompts

• K05: allowed-tools that pre-approves any shell command or an interpreter with any arguments

REVIEW (check before release)

• K11: rm -rf, Remove-Item -Recurse, force pushes, hard resets and DROP TABLE

• K12: network use, with the hosts written in each file

• K13: writes to the home folder, shell startup files, crontab, scheduled tasks, the registry or agent settings

• K14: zero-width characters, Unicode tag characters and bidirectional controls

• K15: missing or invalid name and description in the frontmatter

• K16: executables, archives, bundled dependencies, links outside the skill and long encoded blobs

• K17: frontmatter hooks and dynamic commands that run when the skill loads

• K18: credential reads in a skill without network use

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example skills folder, and the real report the scanner produces on the risky one

Limits

It reads each file as written: commands built at run time, code that scripts download later, and values passed between files under different names are not followed. The wording rules read English. Plugin-level hooks, MCP servers and agents outside skill folders are not read. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 19 files: SKILL.md, the scanner in scripts/ (12 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (9 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.