Vetix — Security skill for Claude Code

Vetix

An LLM-agent-based scanner for [SKILL](https://docs.claude.com/en/docs/claude-code/skills) directories. Vetix pairs deterministic plugin rules with an LLM behavioral analyst so that both obvious indicators of compromise and subtle, obfuscated attack chains get caught in a single pass.

[中文文档](./README_CN.md)

[!WARNING] The [`examples/`](./examples) directory contains sample SKILLs for testing purposes, including deliberately crafted malicious samples. Do not install or load these SKILLs outside of a scanning test environment.

Features

• Plugin-based static scanning — rules catch deterministic security risks.
• LLM cross-validation — every plugin hit is re-judged against the real file content by an LLM, so high-recall rules don't drown the final report.
• Behavioral analysis agent — inside a read-only virtual filesystem, traces the full chain "instruction → tool call → host impact" to uncover risks the rules miss: disguised commands, Base64 payloads, remote code loading, prompt injection, credential theft, persistence, and more.
• Defense-in-depth sandbox — the agent reads only inside the skill, symlinks are refused, every write is rejected at the backend, and mutating tools are hidden from the model.
• Token usage accounting — the report records the token usage of every model call in a scan (prompt / completion / total + call count), so batch scan costs can be estimated.
• LangSmith tracing — every agent run is observable end-to-end.

Parameter

Usage:
  vetix -s  | -p  [flags]

Flags:
  INPUT
    -s, -source string   SKILL directory path or a skills parent directory
    -p, -preset string   Scan all skills under a preset agent skills root (claude-code, codex)

  CONFIG
    -c, -config string   Path to the YAML config file (default "./config.yaml")
    -l, -language string Output language for audit findings (en, zh) (default "en")

  OUTPUT
    -o, -output          Save the audit report to