Skill Scout — Security agent for Claude Code
Discover and security-vet third-party Claude Code skills/plugins/agents/hooks BEFORE installing, in an isolated context.
How to install Skill Scout
Installs to ~/.claude/agents/gesmith0606-claude-config-public-skill-scout.md
mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/gesmith0606/claude-config-public/HEAD/agents/skill-scout.md -o ~/.claude/agents/gesmith0606-claude-config-public-skill-scout.md Restart Claude Code, or start a new session, for it to be picked up.
What Skill Scout does
name: skill-scout description: Discover and security-vet third-party Claude Code skills/plugins/agents/hooks BEFORE installing, in an isolated context. Use when the user wants to find a skill for some capability, or is about to adopt anything third-party into ~/.claude. Returns a clean/flagged/reject verdict + findings; keeps the noisy file dumps and search results out of the main thread. Has no Write/Edit tools, so it cannot install — it only inspects and reports. model: inherit tools: ["Re
Alternatives in Security
- Chain — Supply chain security — SBOM generation, dependency scanning, third-party risk, license compliance 73 ★
- Release Auditor — Pre-release audit for a single plugin in the monorepo — takes a plugin slug and cross-references plugin.json v 72 ★
- Codebase Auditor — Use this agent when the user requests a comprehensive review of the entire project codebase, wants to audit co 62 ★
Full documentation available on GitHub
View Source RepositoryRelated Agents
GitHub Security Auditor
Use this agent when the user references, mentions, or requests the use of any GitHub repository — including fo
Tool Scout
Read-only scout for the /vet pipeline — read a candidate tool's repo / README / docs and return a structured r
iOS Hunter
Hunts one assigned iOS attack surface (IPC and entry points, data storage, network security, binary and secret
Fec Security Reviewer
Focus on front-end and browser-side security reviews: XSS, client key leaks, dangerous DOM/API usage, third-pa
Dependency Vetter
Supply-chain security audit of a third-party package (npm today) at ONE exact resolved version, run BEFORE it
Astro Performance
Delegated by the astro orchestrator during /astro audit to review Core Web Vitals causes, images, CSS/JS deliv
Related Skills
Vet Skill
Static pre-install scanner for AI agent skill bundles — flags prompt-injection phrasing and exfil/remote-exec-
Skill Scout
🔍 Discover + safety-vet Claude Code extensions before you install them - a 0-100 trust score for discovery +
Dsh Plugin Audit
Agent Skill for DeepSeek Harness (DSH):装第三方插件前的静态安全审计 —— 扫出 eval、patch 层 !!js、安装期脚本、开机自启、凭据复制、出网域名与提示词注入面。Audi