> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kalarislabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart: scan your first agent skill

> Scan an AI agent skill with Skill Doctor in under a minute using npx, read the findings, and understand the exit codes.

You need Node.js for `npx`. Nothing else has to be installed.

**1. Scan a skill**

Point Skill Doctor at a skill folder, the directory that contains `SKILL.md`:

```bash theme={null}
npx @security.kalarislabs/skill-doctor scan ./my-skill
```

To scan every skill under a directory, use `scan-all`:

```bash theme={null}
npx @security.kalarislabs/skill-doctor scan-all . --exclude "node_modules/*"
```

**2. Read the findings**

Each finding shows a severity, a threat class ID and what was found:

```text theme={null}
$ skill-doctor scan ./suspicious-skill
HIGH [SD-01] Prompt Injection: ASCII smuggling detected in agent prompt
HIGH [SD-10] Obfuscation: Mixed-script homoglyph "e" (U+0435) in function name
MEDIUM [SD-03] Data Exfiltration: Environment variable $AWS_ACCESS_KEY referenced

Coverage: 94% (comprehensive frontmatter parsed)
Scan complete in 42ms
```

Look up any ID in [threat classes](https://docs.kalarislabs.com/skill-doctor/reference/threat-classes.md). **Coverage** is the share
of the skill's structure that Skill Doctor could parse. Low coverage means part of the skill was not
analyzed.

**3. Check the exit code**

Use the exit code in scripts and CI:

| Code | Meaning |
| - | - |
| `0` | Clean: no findings at or above the threshold |
| `1` | Usage or internal engine error |
| `2` | Findings at or above `--fail-on` (default `HIGH`) |
| `3` | Structural coverage below `--fail-under-coverage` |

**4. Keep it running**

While you write or edit skills, `watch` re-scans each time a file changes:

```bash theme={null}
npx @security.kalarislabs/skill-doctor watch ./skills
```

## Next steps

> [card] [Install](https://docs.kalarislabs.com/skill-doctor/getting-started/installation.md)
>
> npm, cargo or a prebuilt binary.

> [card] [Add to your agent](https://docs.kalarislabs.com/skill-doctor/guides/mcp-server.md)
>
> Let your agent audit skills itself.

> [card] [Gate CI](https://docs.kalarislabs.com/skill-doctor/guides/ci.md)
>
> Block risky skills in pull requests.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.