DEV Community

zenovis2-create
zenovis2-create

Posted on

skillvet: scan AI agent skills before you run them

#javascript #ai #devops #productivity

skillvet: scan AI agent skills before you run them

You dropped a random SKILL.md folder into your agent and trusted it with your shell. It has the same access you do: network, ~/.ssh, every env token. Most of the time it is fine. Most of the time.

skillvet is a one-command supply-chain scanner for AI agent skills and MCP servers. It reads the tree, does not execute it, and prints a RED / YELLOW / GREEN verdict in about five seconds.

npx skillvet ./my-skill
Enter fullscreen mode Exit fullscreen mode

That is the whole install. Node 20+, zero runtime dependencies, no dashboard.

What it flags

It walks the folder and scores five checks. The output below is real, straight from a fixture:

phone-home    +40  undeclared host exfil.attacker.invalid
postinstall   +35  package.json scripts.postinstall
VERDICT  RED   75/100
Enter fullscreen mode Exit fullscreen mode
Check What gets flagged
phone-home HTTP/WS/IPC URLs to hosts the skill never declared, plus child_process, eval(, Function(
secret-access ~/.ssh, ~/.aws, ~/.config, *_TOKEN, GITHUB_TOKEN
postinstall npm preinstall / install / postinstall hooks — automatic YELLOW at least
obfuscation Buffer.from(...,'base64'), atob, hex-string eval, minified sources
binaries non-whitelisted executables (ELF / PE / Mach-O / .exe / .so)

If a skill needs to call a host, it can declare it:

---
name: ship-it
description: Opens a pull request on GitHub.
allowed-domains:
  - api.github.com
---
Enter fullscreen mode Exit fullscreen mode

Declared hosts don't count as phone-home.

Why now

In August 2026 researchers flagged about 7,600 malicious GitHub repositories, and 800+ of them were posing as AI skills or MCP servers. A GitHub takeover of the 25k-star Blender MCP repo showed how fast a "just paste this skill" habit becomes a supply-chain incident.

Developers are still dropping unsigned SKILL.md folders into agents with no review. skillvet is the five-second check before that happens.

The honest limits

It is not a sandbox. It will not catch a clever adversary, and a GREEN is not a proof of safety. It catches the stuff that is already in the wild: install hooks, stolen-token reads, mystery binaries, and a fetch to a domain the skill never declared.

Try it 

npx skillvet ./my-skill
npx skillvet https://github.com/some-user/some-skill
npx skillvet ./my-skill --json   # for CI, exit code 0/1/2
Enter fullscreen mode Exit fullscreen mode

Repo: github.com/zenovis2-create/skillvet — MIT.

Top comments (0)