SkillTrace — Development skill for Claude Code
Behavioral scanner for Claude Skills: sandboxes and traces what a skill actually does instead of trusting its description.
How to install SkillTrace
This entry records only its repository, not the path inside it, so there is no
exact command to give. Open handcraftedbygod/SkillTrace and copy the folder into
~/.claude/skills/, or the file into ~/.claude/agents/.
What SkillTrace does
Behavioral scanner for Claude Skills: sandboxes and traces what a skill actually does instead of trusting its description.
Alternatives in Development
- Career-Ops For Codex — Read CLAUDE.md for all project instructions, routing, and behavioral rules 32.5k ★
- Microsandbox — Open-source self-hosted MicroVM sandboxes with sub-200ms startup, hardware-level isolation via libkrun 5k ★
- Hivemind — Hivemind turns your traces into reusable skills across agents 1.6k ★
README
🛡️ SkillTrace
[](https://pypi.org/project/skilltrace/) [](https://pypi.org/project/skilltrace/) [](https://github.com/handcraftedbygod/SkillTrace/actions/workflows/ci.yml) [](LICENSE)  
**A defensive, behavioral scanner for agent skills — Claude, Cursor, and Codex — built to close the detection gap SkillCloak identified in static-only tools.**
A July 2026 academic paper ([arXiv:2607.02357](https://arxiv.org/abs/2607.02357), HKUST) disclosed **SkillCloak**: malicious Claude/Codex skills that hide payloads (self-extracting blobs, obfuscated instructions in `.git/`-style paths) and evade static scanners more than 90% of the time. It made Hacker News and thehackernews.com. Every "skill security" tool available at the time was static-analysis-only, which is exactly what the paper shows is bypassable.
Traditional malware scanners inspect code. An agent skill can carry out its entire attack as natural-language instructions that an agent reads and follows with its own already-granted tool access, no executable payload required at all. That changes the detection problem from binary inspection to behavioral verification. SkillTrace runs a candidate skill inside a disposable, network-sandboxed container and reports what it *actually* does: network destinations (including decrypted HTTPS host/path/body), subprocess spawns, and out-of-scope file access, instead of just trusting its
Related Skills
Offload
Claude Code skill: delegate plan execution to agy (Antigravity/Gemini) subagents, with an evidence gate instea
Offer Toolkit Skill
Full job-hunt Claude skill bundle — Job Description decoder + Resume builder (11 templates) + Behavioral Inter
Competitor Backlink Scanner
Reads a competitor backlink export from Ahrefs, Semrush, Moz or Majestic, strips out the links you can never w
Reddit Research Agent
Read-only Reddit research MCP server. Finds the subreddits where a topic is actually discussed, ranks threads
Ralph Go
Start the autonomous Ralph loop. Usage: /ralph-go [cautious standard trusting]
Add MCP Server
Add an MCP server to the current project the safe way — pick the transport and scope, wire secrets through env
Related Agents
Ava Issue Triage
Triages open GitHub issues — ranks them by real user impact rather than by label, verifies claims against the
Contact Builder
Finds the person who can actually sell the company and a route that reaches them — establishing decision autho
Forge Verify
Forge's Verification agent — actually drives the running app/build to confirm a change works, rather than trus
