Quickstart: scan your first agent skill

You need Node.js for npx. Nothing else has to be installed.

Scan a skill

Point Skill Doctor at a skill folder, the directory that contains SKILL.md:

npx @security.kalarislabs/skill-doctor scan ./my-skill

To scan every skill under a directory, use scan-all:

npx @security.kalarislabs/skill-doctor scan-all . --exclude "node_modules/*"

Read the findings

Each finding shows a severity, a threat class ID and what was found:

$ skill-doctor scan ./suspicious-skill
HIGH [SD-01] Prompt Injection: ASCII smuggling detected in agent prompt
HIGH [SD-10] Obfuscation: Mixed-script homoglyph "e" (U+0435) in function name
MEDIUM [SD-03] Data Exfiltration: Environment variable $AWS_ACCESS_KEY referenced

Coverage: 94% (comprehensive frontmatter parsed)
Scan complete in 42ms

Look up any ID in threat classes. Coverage is the share of the skill’s structure that Skill Doctor could parse. Low coverage means part of the skill was not analyzed.

Check the exit code

Use the exit code in scripts and CI:

Code	Meaning
`0`	Clean: no findings at or above the threshold
`1`	Usage or internal engine error
`2`	Findings at or above `--fail-on` (default `HIGH`)
`3`	Structural coverage below `--fail-under-coverage`

Keep it running

While you write or edit skills, watch re-scans each time a file changes:

npx @security.kalarislabs/skill-doctor watch ./skills

Next steps

Install

npm, cargo or a prebuilt binary.

Add to your agent

Let your agent audit skills itself.

Gate CI

Block risky skills in pull requests.

⌘I

Get started

Guides

Reference

Quickstart: scan your first agent skill

Next steps

Install

Add to your agent

Gate CI

​Next steps

Install

Add to your agent

Gate CI

Next steps