skillguard

What is SkillGuard, and what makes it different from a general-purpose security scanner?SkillGuard is a static-analysis scanner purpose-built for one threat model: third-party AI agent-skill files,SKILL.mdmanifests plus the hooks and scripts they bundle. It ships ten rule categories (SG01-SG10) targeting things generic scanners don't check for by default, frontmatter-declared scope versus actual behavior, install-time hook supply-chain risk, prompt injection embedded in a skill's own instructional text, and combined risk across multiple skills in the same directory. A general SAST tool like Semgrep can find some of the same code-level patterns, but it has no notion of aSKILL.mdmanifest or a cross-skill privilege relationship.

Does SkillGuard require an account or API token to run a scan?No.npx skillguard-cli scan <path>andpip install skillguard-cli && skillguard scan <path>both work with zero signup, zero token, and no network call at scan time.

What platforms and language runtimes does SkillGuard support?The npm package needs Node.js >=20 (perpackage.json'senginesfield) and has no native/compiled dependencies. The PyPI package needs Python >=3.9 for the base install, or >=3.10 if you install the optionalmcpextra for MCP server mode (perpyproject.toml'srequires-pythonand itsmcpoptional-dependency comment). Both are pure-language packages with no OS-specific build step, and the Python package's classifiers declareOperating System :: OS Independent.

What do SG08, SG09, and SG10 check, and can they run through the MCP server too?SG08 (HIGH) looks for prompt injection inside a skill's own instructional text, attempts to override the host agent's system prompt or hijack its tool routing, across 7 distinct rule IDs. SG09 (HIGH) is cross-skill privilege chaining:scan-setflags a HIGH finding when one skill in a directory has sensitive-filesystem-read capability and another has network-egress capability with no declared sandboxing between them; TypeScript's plainscanalso runs a narrower sibling-path variant of the same check. SG10 (HIGH) is marketplace typosquatting: a skill's declared name sitting Levenshtein edit-distance 1-2 from a bundled list of 51 popular npm/PyPI package names. All three run throughnpx skillguard-cli mcp'sscan_skilltool exactly as they do through the CLI, since the MCP server calls the same underlying scan logic.

Can an AI agent call SkillGuard directly, instead of shelling out to a CLI and parsing output?Yes.npx skillguard-cli mcp(orskillguard mcpon the Python side) starts a stdio MCP server exposing ascan_skilltool, so an orchestrator or coding agent can scan a downloaded skill as a normal tool call before installing or running it.

Does SkillGuard catch a skill that references another, more privileged skill?scan-setdoes: point it at a directory of skill subdirectories and it flags a HIGH finding when one skill has sensitive-filesystem-read capability and another has network-egress capability with no declared sandboxing between them. This is the specific gap Snyk Agent Scan's own issue tracker confirms their tool doesn't cover yet (single-file, non-recursive).

What's the difference between the npm package and the PyPI package?Both are independent, equally maintained ports reading the same rule-pack contract and producing matching findings against the same target; the PyPI package is a genuine Python implementation, not a wrapper around the Node binary. One current gap: TypeScript'sscancommand runs an extra sibling-path cross-skill heuristic that Python doesn't have yet (Python's cross-skill detection lives entirely inscan-set). If you rely on cross-skill detection from a singlescancall rather thanscan-set, that path is TypeScript-only today, runscan-seton the Python side instead to get equivalent coverage.

Does SkillGuard replace Semgrep or Snyk?No. Semgrep is a mature, general-purpose static-analysis engine across 30+ languages; Snyk covers dependency and code vulnerabilities broadly, and Snyk Agent Scan covers a wider set of agent-skill and MCP-config threats than SkillGuard does today. SkillGuard's job is narrower: the specific SKILL.md/hooks/frontmatter threat model, with zero auth and a cross-skill check neither of those tools currently ships.

Is SkillGuard production-ready?It's early: about a month old, pre-1.0, 1 GitHub star as of this writing. The test suite (157/157 TypeScript, 110/110 Python) passes on a clean install and every command in this README was independently re-run against the current code, but it hasn't been run against a large real-world corpus yet, so treat its false-positive/false-negative rate as unproven at scale rather than settled.