Skanna

Security scanner for Claude Code skills, plugins, and MCP servers. A verdict before you install.

Skills and plugins are code plus instructions that you hand to an agent holding your shell, your files, and your credentials. People install them from marketplace links and pasted GitHub URLs on vibes. That is a supply chain, and it has all the classic attack shapes: hooks that fire automatically on session start, install scripts piped from the network, credential reads paired with outbound calls, and prompt injection hiding in the instruction text itself.

skanna reads the whole package (SKILL.md files, scripts, hooks, manifests) and returns SAFE / CAUTION / DANGEROUS with file:line findings and a go / no-go recommendation. It never executes anything from the target.

/skanna https://github.com/someone/cool-skill
/skanna ~/.claude/skills/foo

"Skanna" is Swedish for "scan".

Install

As a plugin (recommended):

/plugin marketplace add proluct/skanna
/plugin install skanna@skanna

Or manually: copy skills/skanna/ into ~/.claude/skills/ and restart Claude Code.

No API key, no dependencies, no per-scan cost. The scanner is the model you are already running, pointed at the right things with the right suspicions.

What it checks

One rule file per danger family, in [skills/skanna/references/rules/](skills/skanna/references/rules/):

| Rule family | Looks for | |---|---| | autorun-hooks | SessionStart / PreToolUse / Stop hooks that run code before you ever review it | | piped-network-install | curl \| bash, iwr \| iex, postinstall scripts fetching remote code | | credential-access | reads of .env, SSH keys, keychains, browser cookies, token-paste prompts | | exfiltration | outbound calls carrying file contents, env vars, or conversation text | | obfuscation | base64 + eval, minified blobs, instructions you cannot read | | prompt-injection | instruction text that hijacks the agent against its user | | destructive-operations | mass deletion, force pushes, config overwrites outside the package | | windows-persistence | registry Run keys, scheduled tasks, encoded PowerShell (plus unix siblings) |

Each rule states its signals, why they are dangerous, where they hide, and the benign look-alikes that must NOT be flagged. False-positive discipline is part of the spec.

Guarantees

• Read-only, always. The target is never executed, installed, or invoked. No npm install, no running install scripts, no invoking the skill under review.
• Remote targets are shallow-cloned to a temp directory outside your working repos, and cleaned up after.
• Every finding cites file:line. A finding that cannot point at a location does not ship.

Limitations, honestly

This is a static review performed by a language model, not a sandbox, not taint analysis, and not a proof. Treat DANGEROUS as a hard no-install. Treat SAFE as "nothing found", not a certification. Sufficiently determined obfuscation can beat any static reviewer; skanna's job is to make the cheap attacks expensive.

Contributing

Detection rules are markdown. Adding one is a small, well-defined PR: one rule file plus one inert fixture under examples/ that triggers it. See [CONTRIBUTING.md](CONTRIBUTING.md). Issues tagged new-rule are good first contributions.

Related

skill-press is the companion project: a test-gated factory that builds Claude Code skills. skill-press builds them, skanna vets them.

Roadmap

• npx skanna standalone CLI wrapper
• CI action: scan skill/plugin PRs automatically
• Deeper MCP manifest checks (declared vs actually-read env vars)

License

MIT

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: proluct
• Source: proluct/skanna
• License: MIT

Install and usage instructions live in the source repository linked above.