skillvet: scan AI agent skills before you run them

zenovis2-create — Sat, 22 Aug 2026 07:51:46 +0000

skillvet: scan AI agent skills before you run them

You dropped a random SKILL.md folder into your agent and trusted it with your shell. It has the same access you do: network, ~/.ssh, every env token. Most of the time it is fine. Most of the time.

skillvet is a one-command supply-chain scanner for AI agent skills and MCP servers. It reads the tree, does not execute it, and prints a RED / YELLOW / GREEN verdict in about five seconds.

npx skillvet ./my-skill

That is the whole install. Node 20+, zero runtime dependencies, no dashboard.

What it flags

It walks the folder and scores five checks. The output below is real, straight from a fixture:

phone-home    +40  undeclared host exfil.attacker.invalid
postinstall   +35  package.json scripts.postinstall
VERDICT  RED   75/100

Check	What gets flagged
phone-home	HTTP/WS/IPC URLs to hosts the skill never declared, plus `child_process`, `eval(`, `Function(`
secret-access	`~/.ssh`, `~/.aws`, `~/.config`, `*_TOKEN`, `GITHUB_TOKEN`
postinstall	npm `preinstall` / `install` / `postinstall` hooks — automatic YELLOW at least
obfuscation	`Buffer.from(...,'base64')`, `atob`, hex-string `eval`, minified sources
binaries	non-whitelisted executables (ELF / PE / Mach-O / `.exe` / `.so`)

If a skill needs to call a host, it can declare it:

---
name: ship-it
description: Opens a pull request on GitHub.
allowed-domains:
  - api.github.com
---

Declared hosts don't count as phone-home.

Why now

In August 2026 researchers flagged about 7,600 malicious GitHub repositories, and 800+ of them were posing as AI skills or MCP servers. A GitHub takeover of the 25k-star Blender MCP repo showed how fast a "just paste this skill" habit becomes a supply-chain incident.

Developers are still dropping unsigned SKILL.md folders into agents with no review. skillvet is the five-second check before that happens.

The honest limits

It is not a sandbox. It will not catch a clever adversary, and a GREEN is not a proof of safety. It catches the stuff that is already in the wild: install hooks, stolen-token reads, mystery binaries, and a fetch to a domain the skill never declared.

Try it

npx skillvet ./my-skill
npx skillvet https://github.com/some-user/some-skill
npx skillvet ./my-skill --json   # for CI, exit code 0/1/2

Repo: github.com/zenovis2-create/skillvet — MIT.

DEV Community: zenovis2-create

skillvet: scan AI agent skills before you run them

skillvet: scan AI agent skills before you run them

What it flags

Why now

The honest limits

Try it