Skills Sentry: a static scanner for agent skill bundles

import Tabs from ' @theme /Tabs'; import TabItem from ' @theme /TabItem'; The Hook If you install "skills" from a public marketplace, you are installing trust, so I built a static scanner that scores a skill bundle before it touches my machine. Why I Built It Two quotes were enough to justify a guardrail. Daniel Lockyer: "malware found in the top downloaded skill on clawhub and so it begins." Elon Musk: "Here we go." That is the whole pattern: popularity becomes distribution, and distribution becomes the exploit. The scary part is not a single bad skill. It is the workflow. Skills often ship as a mix of code plus setup instructions. If that skill can convince you to run one command, it can bootstrap anything after that. So I wanted a quick, local, boring gate: point it at a skill bundle and get a risk report. The Solution Skills Sentry is a static scanner. It does not "detect malware." It detects risky behavior and risky intent. It looks for: Remote script execution patterns (curl or w