pezhik

Skilltotal — Development skill for Claude Code

Development community

Claude Code plugin that scans a package before the agent runs npx, npm install, pip install, uvx or claude mcp add.

How to install Skilltotal

This entry records only its repository, not the path inside it, so there is no exact command to give. Open pezhik/skilltotal and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Skilltotal does

Claude Code plugin that scans a package before the agent runs npx, npm install, pip install, uvx or claude mcp add. Malicious indicators block the install. High-risk packages need your approval. The scan runs on your machine and never executes the code or calls an LLM. Every finding cites a file and line. Also a CLI, GitHub Action and MCP server.

Alternatives in Development

Gemini CLI Foundations — This repository is a comprehensive skills library for Gemini CLI - reusable, production-ready skill packages t 5.3k ★
Governance Review Agent — Chains adoption-report, drift detection scoped to at-risk teams, and stakeholder-brief into a periodic governa 194 ★
Kimicc — 一步命令 npx kimicc 使用 Kimi K2 运行 Claude Code 192 ★

README

SkillTotal

[![PyPI](https://img.shields.io/pypi/v/skilltotal)](https://pypi.org/project/skilltotal/) [![Python](https://img.shields.io/pypi/pyversions/skilltotal)](https://pypi.org/project/skilltotal/) [![License](https://img.shields.io/pypi/l/skilltotal)](https://github.com/pezhik/skilltotal/blob/main/LICENSE) [![CI](https://github.com/pezhik/skilltotal/actions/workflows/ci.yml/badge.svg)](https://github.com/pezhik/skilltotal/actions/workflows/ci.yml) [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/pezhik/skilltotal/badge)](https://scorecard.dev/viewer/?uri=github.com/pezhik/skilltotal)

**Scan packages before Claude Code installs them.** SkillTotal is a static security scanner for what coding agents install: npm and PyPI packages, MCP servers, agent skills and git repositories. It runs on your machine, never executes the code it reads and never calls an LLM. Every finding cites the file and line it came from.

Quick start

pipx install skilltotal

Then, inside Claude Code:

/plugin marketplace add pezhik/skilltotal
/plugin install skilltotal@skilltotal
/reload-plugins

From then on, when the agent runs `npx`, `npm install`, `pip install`, `uvx` or `claude mcp add`, the plugin first scans the package the command names. If the package has malicious indicators, the command is denied and the agent is told what was found and where:

SkillTotal blocked this install: it found malicious indicators. npm:some-pkg@1.0.3:
Decode-and-execute (obfuscated execution) at `scripts/setup.js:4`. Run
`skilltotal scan npm:some-pkg@1.0.3` to see every finding with its file:line evidence.

Without the plugin, scan anything from a terminal:

skilltotal scan npm:some-package         # or pypi:name, a git URL, a local folder or an archive
skilltotal guard npm:some-mcp-server     # exit code 2 if it should not be installed

**Try it online (no install, no account):** [www.skilltotal