Skillxray

skillxray

Run this before you install or trust an AI agent skill you didn't write - a SKILL.md, a Claude Code plugin, an MCP bundle, or a whole directory of them. It reads the files and flags what a quick glance would miss: instructions aimed at the agent instead of the user, invisible Unicode, curl-pipe-sh and reverse shells, exfiltration to an outside host, leaked keys, and hooks that run on their own. It tells you what's wrong and where; it doesn't fix it for you.

When to use it

Before:

• installing a third-party skill, plugin, or MCP server someone else wrote
• trusting a SKILL.md pulled from a repo or a registry
• adding a skill bundle to a shared or automated environment

Run it and read the findings before the skill is live, not after.

How to run it

Point it at a skill directory, a single SKILL.md, or a directory of skills:

skillxray  --json

`` defaults to the current directory. To vet something you haven't cloned yet, let skillxray do the shallow read-only clone itself:

skillxray --git https://github.com/owner/some-skill --ref main --json

--json gives machine-readable output; --sarif emits SARIF 2.1.0 for the GitHub Security tab; leave both off for the colored human report. --quiet prints just the summary line and grade.

Reading the result

Every scan ends in a letter grade, A through F. Any critical finding drops it straight to F; high-severity findings cap it below an A. The grade is the five-second read; the findings under it are the reason.

The exit code is what to gate on in CI or a script: skillxray exits non-zero when any finding lands at or above --fail-on (critical|high|medium|low|info|none, default high). So a default run passes on low/medium hygiene notes and fails on the things that actually get you owned.

A clean grade means skillxray didn't find one of the patterns it checks for, not that the skill is safe to run blind. Read what it flagged, and for anything it grades below an A, understand the specific finding before you decide to trust the skill anyway - the report names the rule and the line so you can go look.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: munzzyy
• Source: munzzyy/skillxray
• License: MIT
• Homepage: https://pypi.org/project/skillxray/

Install and usage instructions live in the source repository linked above.