Teycir/SkillsGuard

What it is

SkillsGuard, a zero-dependency static scanner for AI agent skill packages. The page adds operational details the summary omits: how to actually run it, an alternative hosted endpoint, and an honest comparison against its closest competitor, SkillSpector.

How it works

Findings pipeline: load skillsguard.config.json (auto-discovered by walking up to the filesystem root) → discover/filter files (JS, PY, PS1, Dockerfile, Ruby/Gemfile) → apply 100+ raw-text rules AND separately extract encoded blobs via decode.ts, recursively decode base64/hex/URL to depth 2, then scan the decoded content → deduplicate (each rule fires at most once per file per line) → compute risk score 0–100 → emit CLI/JSON/SARIF/MCP. Exit is gated on --max-risk. No execution or sandboxing; purely static.

Preconditions / Affected

Requires Node ≥ 18.3; nothing else — no account, API token, LLM endpoint, or network call. Note it is not published on npm, so you must build from source.

What to do

Install and scan:

git clone https://github.com/Teycir/SkillsGuard.git
cd SkillsGuard
npm install
npm run build
npm link
skillsguard /path/to/skill

Exit codes: 0 = clean, 1 = findings, 2 = usage error — gate CI on these.

Scan a single file without installing anything, via the hosted worker:

curl -s --data-binary @SKILL.md \
  https://skillsguard.apiskillsguard.workers.dev/scan | jq .

Other actions the page states: skillsguard install-hook (pre-commit block), --diff/--staged for git-diff-only scans, --json/--sarif for CI, and an MCP stdio server exposing one scan_skill tool for direct agent integration.

Caveats

• The author's own "honest take": SkillSpector is the most architecturally similar tool, has more research weight (a published study of 42,447 skills, 26.1% found vulnerable), and adds an LLM semantic stage that catches intent-level issues regex cannot — e.g. a skill claiming to format code that quietly reads ~/.ssh. The page recommends scanning with both and comparing, not picking blind.
• Recursive decoding stops at depth 2; payloads encoded beyond two layers fall outside this unwrapping.
• Positioning is explicit: SkillsGuard is the deterministic offline CI/pre-commit gate; LLM-augmented scanners (NVIDIA, Cisco, Snyk, SkillScan) are the better choice for semantic review of new or high-privilege skills. The page frames them as complementary, not either/or.
• The README carries a solicitation for ETH donations to fund ongoing rule development — a signal about the project's maintenance/funding model.