Skip to main content
Skill Doctor security scanner for AI agent skill files Skill Doctor audits AI agent skills before your agent loads them. It reads SKILL.md bundles, tool schemas and companion scripts, and reports prompt injection, hidden command execution, credential exfiltration and persistent backdoors. It is written in Rust, runs offline by default and does not use a model to decide what is safe.

Quickstart

Run your first scan in under a minute, with no installation.

Add to your agent

Register Skill Doctor as an MCP server in Claude Code, Cursor or Windsurf.

Gate CI

Fail pull requests that add risky skills, and upload SARIF reports.

What it detects

The 11 threat classes, from SD-01 to SD-11.

​
Why skills need a scanner

Agent skills are natural-language instructions that an agent runs with real system access: shell tools, filesystem APIs and network sockets. They are usually installed from public repositories without code signing or sandboxing. A skill can carry:
  • Prompt injection hidden in Markdown headings, HTML comments or Unicode tag characters.
  • Hidden command execution in companion scripts (eval, exec, child processes).
  • Credential exfiltration that reads .env files, cloud tokens or SSH keys and sends them out.
  • Persistent backdoors written into auto-loaded agent directories such as .claude/ or ~/.bashrc.
Model-based detectors are slow, cost money per scan, give different answers on the same input, and can be fooled by the injections they are meant to catch. Skill Doctor’s default layer is deterministic: the same input always produces the same findings.

​
How it works

Skill Doctor checks a skill in four layers. Only the first runs by default.
Higher layers can only add findings. L2 and L3 may report more problems, but they can never suppress, dismiss or downgrade a finding from L1.

​
Who it is for

  • Engineers who ship agent skills or plugins and want a check before release.
  • Registry and marketplace operators screening submitted skills.
  • Security teams adding skill audits to CI/CD.
  • Researchers studying agent threats and prompt injection defenses.

GitHub

Source, issues and discussions.

npm

@security.kalarislabs/skill-doctor

crates.io

skill-doctor
Skill Doctor is Apache-2.0 licensed and maintained by Kalaris Labs. Report vulnerabilities privately through GitHub Security Advisories.