Frequently Asked Questions

skillsmith.ch · Claude Agent Skill security

What is skillsmith?

skillsmith is an open-source security scanner for Claude Agent Skills (SKILL.md files). Paste a skill or point it at a GitHub URL and get a risk verdict with plain-language findings in seconds. There is also a REST API, an MCP server, a behavioral sandbox, and a Python CLI (skillsmith-scanner on PyPI).

Is skillsmith free?

Yes. Sign-in is free and includes 5 scans/day. Paid tiers exist for heavier use (Pro: 100 scans/day; pay-per-use single scans from $0.02). Payments are handled via USDC on Solana — no credit card required. Scanning one file by hand will never cost anything.

Can a "clean" result be wrong?

Yes. skillsmith is a static heuristic scanner. It does not execute the skill. A clean verdict means no known suspicious pattern matched — it is not a guarantee of safety. Likewise, flagged findings can be false positives. Always read short files yourself before running them; that is why every finding ships with a human-readable explanation.

What is the behavioral sandbox?

The behavioral sandbox goes beyond pattern matching: an AI analyst inside an isolated container simulates what an agent following the skill would actually do — step-by-step actions, capabilities, indicators of compromise, and a 0–10 severity score. It catches attacks that never match any string pattern, such as paraphrased exfiltration instructions. The skill is never executed against real systems.

Someone renamed a malicious skill — can you detect that?

Often yes. Every scanned skill gets a "Skill-DNA" fingerprint (simhash). Near-duplicate variants with tiny cosmetic changes stay within Hamming distance ≤12 of known scans and appear via /api/similar. Rug-pull watching (/api/watch) covers the other trick: content that changes after you vetted it.

Do you store my skills publicly?

A scan stores only the hash, verdict metadata and — if you opt in with "publish" — the full content. Private scans keep your skill text private; near-duplicate search masks names of unpublished skills. Clean-scanned skills appear in the public safe-skills registry and feed without their source code unless published.

How do I use skillsmith in CI?

Add the official GitHub Action (or call the API directly) to lint and scan skills in your repository on every push — see the API docs and the repository README. The CLI works offline: pip install skillsmith-scanner, then skillsmith scan ./SKILL.md.

Is the detection engine open source?

Yes — MIT-licensed, including pattern categories inspired by NVIDIA's SkillSpector research (Apache-2.0, credited in-file). Audit the scanner itself at GitHub; we eat our own dog food by scanning every contributed change.

I found a bug or a false positive.

Please open an issue at GitHub Issues — include the SKILL.md (redacted if needed) and the reported verdict. False positives directly improve the engine weights.