rrrrrredy/skill-security-guard

This tool is a static security scanner built for AI agent skill packages, and it works across multiple environments. You can run it as a standalone command-line interface, use it as an OpenClaw skill, or install it as a community bundle for DeepSeek Harness. Since it only relies on the Python standard library, you do not need to install any additional dependencies to run it, and it works on all major desktop operating systems including Windows, macOS, and Linux. It performs a 7-dimension deterministic scan, assigns an A-F risk rating, includes confidence levels for each finding, and provides explicit remediation guidance for any issues it detects.

The scanner is targeted at AI skill developers and maintainers of public agent skill repositories, who need to check for potential security issues before publishing or merging new skill contributions. To get started after cloning the repository, you can run the scan against a local SKILL.md file, a full skill directory, a zipped skill package, inline text input, or even a publicly accessible HTTP/HTTPS URL pointing to a raw skill file. It automatically skips reference documentation to reduce false positives, but you can include it with the --include-references flag if you need a full scan. You can also output results in JSON format for automated processing by downstream release tools or skill registries.

This project is released under the open source MIT license, so it is free to use and modify without any licensing costs. The only system requirement is Python 3.10 or newer, and there are no other runtime dependencies to install. As a static scanner, it has explicit limits: it does not execute skills, monitor runtime behavior, verify package provenance, or replace human security review. All findings are intentionally conservative, so you must review all results before taking any action such as blocking a skill release or publication. Contributions to the project and its detection rules are welcome from the open source community.