Skill Sentry

skill-sentry

Read a Skill before it reads your machine.

What it does

skill-sentry is a static, local, explainable audit for Agent Skills. It never runs the scanned Skill and never sends anything anywhere. It reports:

• destructive commands and broad deletes (DEST)
• hidden network requests and download-and-execute pipes (NET)
• secret / credential reads and environment collection (SECRET)
• Base64 / eval / exec / reflection obfuscation (OBF)
• instruction injection and concealment instructions (INJ)
• persistence and privilege-surface changes (PERSIST)
• writes outside the project tree (FS)
• referenced external domains (DOMAIN)

Every hit shows file:line, a rule_id, a reason, a confidence, and a level (INFO / REVIEW / HIGH). Heuristic hits are not the same as confirmed vulnerabilities — HIGH hits require human review.

When to use

• "Audit this Skill before installing"
• "Check this plugin for risks"
• "Scan an Agent Skill for prompt injection"
• "Is this Skill safe to add to my agent?"

How to run

python scripts/audit_skill.py <skill-directory>
# optional policy gate for CI:
python scripts/audit_skill.py <skill-directory> --policy policy.yml --out build/

Outputs (in the skill directory, or --out):

• SKILL_AUDIT.md — human-readable report
• skill-sbom.json — files, scripts, domains, permission surface
• policy-result.json — CI-friendly pass/fail

Supported hosts

Agent Skills directory format for Codex, Claude Code, Cursor, and Gemini CLI. The audit itself is a standalone Python CLI — no host required to run it.

Reference

• references/rule-catalog.md — every rule ID and what it means
• references/false-positive-playbook.md — how to read and triage hits
• assets/policy.example.yml — team policy template