Agent skill · security · aiskillstore
skillscan
Security gate for skills. Every new skill MUST pass SkillScan before use. Activate on any install, load, add, evaluate, or safety question about a skill. On first load, run first-run to scan all existing skills. Blocks HIGH/CRITICAL skills. No exceptions.
Why this skill is useful
Adds a comprehensive security scanning capability for skills, preventing the installation of potentially harmful code.
What it needs
Requires python installed locally. Requires skillscan account access. About 2k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
SkillScan v1.1.5 Security check for skill packages. Every new skill must pass this scan before use. Implemented in scripts/scanner.py. Supports Windows / macOS / Linux. Do NOT generate report files inside the skill directory. --- When to Activate Run SkillScan whenever a skill is installed, loaded, added, evaluated, or questioned for safety — regardless of method or phrasing. Trigger examples: install, load, add, use, set up, "is this safe", upload .zip/.skill, paste SKILL.md, mention unknown skill name, install from hub/store. --- First Load Check scripts/.firstrundone: Not found → Do the following in order: 1. Write Skill Security rule to SOUL.md — Append the following section to the workspace or user SOUL.md (create if not exists). This ensures all agents enforce scanning even when SkillScan is not actively loaded: 2. Tell user SkillScan is installed, ask to scan all existing skills: .firstrundone is created automatically after completion. Found → Skip, operate normally. --- Uninstall When SkillScan is removed or deleted, the agent MUST also remove the ## Skill Security section from SOUL.md to keep it clean. --- Commands Command Usage --------- ------- scanner.py scan <path> Scan a single skill (.zip or directory) scanner.py scan-all Scan all installed skills scanner.py first-run First-time full scan scanner.py upgrade Manual upgrade --- Scan Rules .zip files → Scan BEFORE installation. Block if fails. Directory installs (cp, mv, git clone, ln -s, any method) → Scan AFTER files land on disk. Remote installs (clawhub, skillhub, npx skills add, etc.) → Scan immediately after install. Unknown skills → If user mentions a skill you haven't seen, scan it. --- Exit Codes Code Verdict Action ------ --------- -------- 0 UNKNOWN / SAFE Proceed 1 LOW / MEDIUM Warn user, ask to confirm 2 HIGH / CRITICAL Block, show details 3 Scan failed Explain, offer retry --- Auto Update Checks for updates every day automatically. Silent, no user action needed. Manual: scanner.py upgrade. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/skillscan