WaelAbouceo

Vouch — AI skill for Claude Code

AI community

See what your AI-agent skills can actually do.

How to install Vouch

This entry records only its repository, not the path inside it, so there is no exact command to give. Open WaelAbouceo/vouch and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Vouch does

See what your AI-agent skills can actually do. Vouch audits every SKILL.md on your machine, explains each skill's capabilities in plain English, and flags the risky ones (destructive commands, secret exfiltration, prompt injection). Local, deterministic — like npm audit, but for agent skills.

Alternatives in AI

Paritok 4b V1 — Non-destructive compression gateway for AI coding agents 1.4k ★
Hol Guard — Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, M 485 ★
OpenGhost — Open desktop AI agent for Windows, macOS and Linux, written from scratch: its own agent engine, its own browse 266 ★

README

Vouch

[![CI](https://github.com/WaelAbouceo/vouch/actions/workflows/ci.yml/badge.svg)](https://github.com/WaelAbouceo/vouch/actions/workflows/ci.yml) [![PyPI](https://img.shields.io/pypi/v/vouch-agent.svg)](https://pypi.org/project/vouch-agent/) [![Python](https://img.shields.io/pypi/pyversions/vouch-agent.svg)](https://pypi.org/project/vouch-agent/) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE) [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/WaelAbouceo/vouch/badge)](https://securityscorecards.dev/viewer/?uri=github.com/WaelAbouceo/vouch) [![Status: alpha](https://img.shields.io/badge/status-alpha-orange.svg)](ROADMAP.md)

**Vouch shows you what your AI agents can actually do.** One command scans every skill on your machine, explains in plain English what each one can do, and flags the risky ones.

![Vouch demo](docs/demo.gif)

Your agents (Claude, Cursor, Codex, …) load **skills** — packages of instructions (`SKILL.md`) plus scripts that they read and may execute. They pile up fast, from many sources, and you have no idea what they can do. Vouch tells you.

Quickstart

pipx run --spec vouch-agent vouch --audit   # zero-install; runs in an isolated env

Or install it, then run:

pip install vouch-agent      # zero dependencies; static analysis works out of the box
vouch --audit                # scan every skill on this machine

**On Debian/Ubuntu (or any PEP-668 "externally-managed-environment") system**, a bare `pip install` is blocked by the OS. Use **`pipx install vouch-agent`** (recommended), a virtualenv (`python3 -m venv .venv && . .venv/bin/activate`), or `pip install --user vouch-agent`. The `pipx run` line above needs no install at all.

**Installing the optional extras** (`vouch-agent[mcp]`, `[api]`, `[all]`) into the **system Python** on Debian/Ubuntu can fail even past PEP-668: the `mcp` SDK needs a newer `PyJWT` than the apt-managed one, a