artemasmith

Skillsentinel — Data skill for Claude Code

Data community

Static scanner for AI agent skills: catches prompt injection, dangerous shell commands and data exfiltration in SKILL.md / .claude/skills before you install them.

How to install Skillsentinel

This entry records only its repository, not the path inside it, so there is no exact command to give. Open artemasmith/skillsentinel and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Skillsentinel does

Static scanner for AI agent skills: catches prompt injection, dangerous shell commands and data exfiltration in SKILL.md / .claude/skills before you install them. 44 rules, SARIF output, no dependencies. pip install skillsentinel-cli

Alternatives in Data

LLM Redteam — LLM red-team corpus runner — fires categorized prompt-injection / jailbreak / system-prompt-leak / data-exfil 4.5k ★
Vibesec — Helps write secure code by preventing common vulnerabilities including IDOR, XSS, SQL injection, SSRF, and wea 687 ★
FACT — FACT – Fast Augmented Context Tools: FACT is a lean retrieval pattern that skips vector search 161 ★

README

SkillSentinel scanning malicious, benign and lookalike skill fixtures

*Real captured output: 42 confirmed findings on the malicious corpus, zero on both benign corpora, and detonation egress logs — from the same commands shown in the [demo](#demo) section.*

SkillSentinel — AI-agent skill scanner with post-install drift watch

Русскоязычное резюме: статический сканер AI-скиллов (SKILL.md, mcp.json, скрипты): prompt injection, эксфильтрация кредов, майнеры, persistence, MCP-бэкдоры; плюс то, чего нет у других — отслеживание изменений скилла после установки (rug-pull) и детонация скриптов в песочнице с записью egress.

**Zero-dependency static scanner for AI-agent skills, packs and plugins — plus two things no prior-art scanner does: it keeps watching a skill *after* you install it, and it can *detonate* its scripts in a sandbox to record attempted egress.**

[![CI](https://github.com/artemasmith/skillsentinel/actions/workflows/skillsentinel.yml/badge.svg)](https://github.com/artemasmith/skillsentinel/actions/workflows/skillsentinel.yml) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE) [![Python 3.10+](https://img.shields.io/badge/python-3.10%2B%20%7C%203.11%20%7C%203.12%20%7C%203.13-blue.svg)](pyproject.toml) [![Rules](https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fraw.githubusercontent.com%2Fartemasmith%2Fskillsentinel%2Fv0.3.2%2Frules%2Frules.json&query=%24.rules.length&label=rules&color=purple)](rules/rules.json) [![Dependencies](https://img.shields.io/badge/dependencies-0-success.svg)](#zero-dependencies) [![OWASP Agentic Top 10](https://img.shields.io/badge/mapped%20to-OWASP%20Agentic%20Top%2010-red.svg)](#what-it-detects)

Why this exists

Every scanner in this space — SkillSpector, agent-scan, mcp-scanner — looks at a skill **once, before you install it**. That misses the rug-pull: a repo that is clean when you review it and gain