epistemedeus/skillguard

**Scan a Claude Code skill, plugin, or MCP server for malware *before* you install it.** One command, no install, no account.
Why
The Claude Code / MCP ecosystem is exploding — and so is the attack surface. Researchers have found **71 malicious skills** in the wild, **~26% of published skills carry vulnerabilities**, and **30+ MCP CVEs landed in 60 days**. The most common payloads:
- **Environment-variable / secret exfiltration** (ANTHROPIC_API_KEY, AWS_SECRET_ACCESS_KEY, ~/.env) shipped off to a webhook.
- **Install-time shell hooks** (postinstall) that run code the moment you npm install.
- **Prompt injection in tool descriptions / SKILL.md** ("ignore previous instructions", "do not tell the user", "always auto-approve").
- **Committed binaries** and **obfuscated eval(atob(...)) / curl | bash** payloads.
- **Auto-approve-all / skip-permissions** configs that disarm your safeguards.
SkillGuard catches these patterns in seconds, so you can vet a third-party skill or MCP server before trusting it with your machine and your keys.
Safe by design
SkillGuard does **static analysis only**. It clones with git clone (hooks disabled) and *reads* files — it **never runs npm install, never executes build/postinstall scripts, and never runs the target code.** Scanning a malicious package can't harm you. (A scanner that executed what it's inspecting would be the very risk it's meant to prevent.)
What it checks
| Check | Catches |
|---|---|
| env-exfil | A sensitive env var read next to a network call |
| exfil-host | Hardcoded webhook / pastebin / raw-IP / Telegram exfil endpoints |
| obfuscation | eval(atob(...)), curl \| bash, subprocess on encoded data |
| prompt-injection | Data-exfil / "ignore instructions" / auto-approve text in SKILL.md, tool descriptions, prompts |
| secret-literal | API keys / private keys committed to the repo |
| committed-binary | Compiled ELF / Mach-O / PE executables in the tree |
| forced-artifact | The honeypot pattern: a build step that generates + commits an encrypted blob |
| dangerous-perms | Auto-approve-all, sandbox-disabling, --dangerously-skip-permissions |
| install-hook | pre/postinstall scripts that run on install |
Exit code: 0 clean · 2 suspicious · 3 dangerous — so you can gate CI on it.
Use it in CI (GitHub Action)
Gate your CI on skill/MCP supply-chain safety:
Use it as an MCP server
Give your agent the ability to vet a skill/MCP server before installing it. Add to your Claude Code / MCP client config:
It exposes one tool, scan_skill(target), where target is a local path or a git/GitHub URL. Your agent can then check anything it's about to install. (Static-only — it never runs the scanned code.)
Show that you passed