SkillTrust
AI skill security · v0.x

Read every line of a skill before it reads your machine.

SkillTrust runs the open-source skill-detector engine over any Claude Skill, Codex skill, or third-party AI prompt pack — flagging prompt injection, credential exfiltration, supply-chain risk, and over-broad permissions.

Up to 10 MB · zip only · never executed

No account required to scan Static analysis · never executes the skill Open-source engine
~/scans/awesome-skills/code-reviewer
$ skill-detector scan ./code-reviewer
→ discovering files... 12 yaml · 4 md · 3 sh
→ running 6 rule groups...
HIGH SD-014 prompts/system.md:42
Prompt injection — "ignore previous instructions"
MEDIUM SD-007 scripts/install.sh:3
Unpinned curl | sh pipeline to github.com
MEDIUM SD-022 manifest.yaml:8
Network egress declared but not bounded
LOW SD-003 README.md:91
References ~/.aws/credentials
─────────────────────────────────────
score 62 / 100 (4 findings · 1 HIGH)
exit 2
workflow

Three steps from "looks interesting" to "safe to install."

01

Point us at a skill

Paste a GitHub URL or upload a zip. We work with Claude Skills, Codex skills, and any file-based AI skill format.

02

Engine sweeps the bundle

Six rule families fire in parallel: injection, supply chain, exfiltration, misconfiguration, integrity, access control.

03

Get a focused report

Severity-ranked findings with file paths, evidence, and a shareable link you can paste into Slack or a PR.

coverage

Built for the exact shape of an AI-skill attack.

Generic SAST and secret scanners don't understand skill manifests, system prompts, or permission declarations. SkillTrust does — six rule families, purpose-built for this format.

Prompt injection detection

Catches "ignore previous instructions," hidden role markers, system-override phrases, and obfuscated payloads embedded in SKILL.md or system prompts.

HIGH SD-014, SD-031, SD-047 · 114 known patterns

Exfiltration scanning

Flags reads of .env, .ssh, AWS creds, and outbound HTTP to unknown hosts or paste services.

Permission auditing

Surfaces declared vs. actual capability gaps: shell access, wildcard egress, destructive commands.

Supply-chain checks

Unpinned installs, typosquats, curl | sh pipelines, dependency provenance.

Integrity verification

Ruleset checksum compared at every scan — engine tampering is loud, not silent.

Vet your next skill in under a minute.

No account required. Sign up if you want history, shareable links, and a higher rate limit.