With npx, from skills.sh
RecommendedOne command via the skills.sh installer. Works for any supported harness.
npx skills add bitdefender/agent-skill-scannerQuick answer
Agent Skill Scanner is a Bitdefender agent skill that audits another agent skill before you install or trust it. It walks every file, runs 71 behavioural detectors across 16 threat categories, extracts 18 indicator types, and returns an LLM-generated report with a risk level, summary and per-file findings. Install it with "npx skills add bitdefender/agent-skill-scanner", from GitHub, or as a zip archive.
AnalysesAgent skills
StatusAvailable — skills.sh & GitHub
RequiresPython 3.12 or 3.13
Made byBitdefender
Get it
Three ways to install
Agent Skill Scanner installs in under a minute with npx via skills.sh, by cloning the GitHub repository, or as a zip archive you drop into your skills directory. It runs inside your agent harness and installs its own Python dependencies on first use.
Works in
Claude Code
Codex
OpenClaw
opencode
Hermes Agent
Claude CodeCodexOpenClawopencodeHermes AgentFrom GitHub
Clone the repository and copy the inner agent-skill-scanner/ folder into your skills directory.
git clone https://github.com/bitdefender/agent-skill-scanner.git
cp -r agent-skill-scanner/agent-skill-scanner ~/.claude/skills/As a zip archive
Download the archive, unzip it, and move the inner agent-skill-scanner/ folder into your skills directory: ~/.claude/skills/, ~/.openclaw/skills/, or your project’s skills/.
Download the zip →Then just ask
There is no command to learn. Once installed, paste this prompt into your agent; it handles invocation, target resolution and update checks. Replace the placeholder with a skill name, a directory, a zip, or a URL:
Prompt for your agent
Scan the <skill name or path> skill for security risks and show me the report.Requires Python 3.12 or 3.13 (3.13 recommended). Dependencies install on first use, and optional pieces degrade gracefully: .7z/.rar support, embeddings and signed-update verification each activate only when needed. Scanning .rar targets additionally needs a system unrar or unar binary on your PATH.
To uninstall, delete the agent-skill-scanner folder from your skills directory.
What is Agent Skill Scanner?
Agent skills are executable code plus natural-language instructions that run with your agent’s privileges. A single malicious or careless skill can exfiltrate secrets, open a reverse shell, mine cryptocurrency, phone home, or hide a delayed trigger. Agent Skill Scanner audits a skill before you trust it: it walks every file, extracts security indicators, runs behavioural detectors, and returns an LLM-generated security report with a risk level, a summary, and per-file findings.
Type
Agent skill, runs inside your harness
Works in
Claude Code, Codex, OpenClaw, opencode, and similar
Requires
Python 3.12 or 3.13
Detection
71 behavioural detectors, 16 threat categories
Indicators
18 indicator types extracted per text file
Get it from
skills.sh · GitHub · zip archive
Detection coverage
What it detects
Agent Skill Scanner runs 71 behavioural detectors across 16 threat categories, including code execution, obfuscation, reverse shells, crypto-mining, persistence, time bombs and stealth natural-language directives. It also extracts 18 indicator types from every text file: URLs, IPs, base64 blobs, dangerous shell commands, secret env-var names and invisible Unicode characters among them.
Show all 16 threat categories
| Threat category | Examples |
|---|---|
| Code execution | eval/exec, dynamic __import__, JS Function(), PowerShell Invoke-Expression |
| Subprocess usage | shell=True, os.system, os.popen |
| Obfuscation | base64-decode-then-exec, hex decoding, chr() construction, known encoded payloads |
| Network | requests/httpx/urllib, raw sockets, fetch(), connections to raw IPs |
| File operations | writes, deletions, bulk shutil ops, destructive rm -rf |
| Crypto-mining | xmrig, stratum, mining-pool indicators |
| Reverse shells | /dev/tcp, nc -e, bash -i >&, pty.spawn |
| Download-and-execute | curl … | sh, pip/npm install from URL, npx without approval |
| Credential access | bulk environment-variable harvesting |
| System persistence | cron, systemd, launchd, Windows registry run-keys |
| Privilege escalation | sudo, dangerous chmod, chown root, writes to system paths |
| Path traversal | ../../.., URL-encoded traversal |
| Telemetry | analytics and tracking SDKs, sendBeacon, phone-home |
| Symlink attacks | ln -s, os.symlink, Node fs.symlink |
| Time bombs | date and timestamp-comparison triggers, delayed execution |
| Stealth directives | natural-language exfiltration, covert-action and hidden-memory instructions |
18 indicator types are extracted from every text file: URLs, IPv4 addresses, data/javascript: URIs, emails, base64 blobs (decoded and inspected), percent-encoded URLs, environment-variable references, 25 dangerous shell commands, sensitive file paths, suspicious imports, private/loopback IPs, crypto-wallet addresses, known secret env-var names, paste-service domains, DNS-exfiltration patterns, and invisible Unicode characters.
Structural checks cover hidden dotfiles, package install-hooks (preinstall/postinstall, setup.py cmdclass), per-file SHA-256 and MD5 hashing, and a normalized skill-level hash used for report caching.
Built for how skills actually hide things
Layered analysis
Local indicator extraction feeds a server-side LLM that produces the report: a risk level, a plain-language summary, and per-file findings. Enough to decide, without wading through raw indicators.
Deep archive inspection
The scanner recursively unpacks .zip, .tar.gz, .tar.bz2, .tar, .7z and .rar up to 10 levels deep, with limits of 500 MB uncompressed and 10,000 entries per archive. It skips symlinks rather than following them.
Prose-aware detection
Natural-language threats hidden in SKILL.md instructions (stealth exfiltration, covert actions, keyword and counter triggers) are first-class detections.
Semantic embeddings
The scanner computes local sentence embeddings (all-MiniLM-L6-v2, ONNX) to support the analysis. They run on your machine, and you can disable them.
Privacy-respecting default
In scan mode the scanner transmits only hashes, extracted indicators and metadata; full files are never uploaded. Full-archive upload happens only in the explicit, opt-in submit mode.
Flexible targets
Scan a directory, an installed skill by name, a .zip archive, or a URL. The skill resolves whatever you refer to in plain language.
How a scan works
You ask in plain language, “scan the foo skill for security risks”, and the skill does the rest. There is no separate command-line tool to learn.
1. Resolve
The scanner resolves the target (a directory, an installed skill name, a zip, or a URL) into a skill root.
2. Pack & hash
It packs the skill into a normalized archive and computes a skill-level SHA-256, then checks for a cached report before repeating any work.
3. Collect & enrich
It walks, hashes and recurses into every file, then runs all 18 indicator extractors and 71 behavioural patterns over the text content.
4. Embed
It computes semantic embeddings on your machine, unless you disable them.
5. Submit metadata
Hashes, indicators with short matched excerpts, counts, metadata and embeddings go to the backend. In scan mode it sends no full file contents.
6. Report
The backend returns a risk level, summary and findings, rendered as Markdown in your session.
Trust & transparency
What leaves your machine
Two modes, both agent-driven. Scan is the default: only hashes, extracted indicators and metadata are transmitted, and full files are never uploaded. Submit is opt-in: the complete skill archive is uploaded for deeper analysis, and only when you explicitly ask for it.
| Mode | Transmitted |
|---|---|
| Scan (default) | File hashes (SHA-256/MD5), extracted indicators and pattern matches — including short excerpts of matched content (regex fragments ≤100 chars, decoded base64 snippets ≤500 chars) — file metadata, finding counts, SKILL.md frontmatter, dependency metadata, and local embeddings. Full file contents are not transmitted. |
| Submit (opt-in) | The complete skill archive, uploaded for deep analysis. The agent will not do this unless you explicitly ask. |
The contract the agent is held to
- Scan mode is the default: a casual request never uploads your files.
- Submit is opt-in only: the agent won’t upload the full archive unless you explicitly ask.
- The agent relays, it doesn’t overrule: it presents the backend’s report and never substitutes its own verdict.
- Errors are surfaced as they are: on failure you get the specific reason.
- Self-updates are Ed25519-signature-verified against a key pinned in the client, staged with path-traversal-safe extraction, and rolled back automatically on failure.
A scan that returns no findings means no known threat patterns were detected — not that the skill is safe.
What you can point it at
The scanner accepts four target types: a directory, an installed skill name, a zip archive, or a URL.
| Target | Behaviour |
|---|---|
| Directory path | Scanned directly as the skill root. |
| Skill name | Resolved via the harness’s known skill directories, project- and user-level. |
| .zip archive | Extracted to a temp directory, then scanned. |
| URL | Sent to the backend for scanning (scan mode only). |
Why trust it
Built by Bitdefender
Agent Skill Scanner is made by Bitdefender, the company that has protected people and organisations since 2001. The figures and recognitions below describe Bitdefender the company — not the scanner itself. Why millions trust Bitdefender →
50B+
threats blocked every year
580+
technology patents
170+
countries protected
15+
years of AI-driven security
50%+
of employees work in R&D
30+
law-enforcement partnerships
Brand partnership
Trusted by Ferrari as cybersecurity partner
A partnership born from a passion for high performance and technological innovation — Bitdefender supports Ferrari with Advanced Threat Intelligence to improve detection and response to cyber threats.
Learn more →Brand recognition
Award-winning security software you can trust. Always.
Consistently top-ranked by the world’s leading independent testing labs and tech publications.
Learn more →Heritage: AI in cybersecurity since 2008 — 70+ academic papers and 50+ researchers behind Bitdefender's AI.
Frequently asked questions
What is Agent Skill Scanner?
Agent Skill Scanner is a Bitdefender agent skill that audits other agent skills before you install or trust them. It runs 71 behavioural detectors across 16 threat categories, extracts 18 indicator types from every file, and returns an LLM-generated security report with a risk level, summary, and per-file findings.
How do I install Agent Skill Scanner?
Three ways: run “npx skills add bitdefender/agent-skill-scanner” via skills.sh; clone the GitHub repository and copy the agent-skill-scanner folder into your skills directory; or download the zip archive and unzip it there. It requires Python 3.12 or 3.13 and installs its own dependencies on first use.
How do I scan a skill?
Ask your agent in plain language, for example “scan the foo skill for security risks”. There is no separate command to learn: the harness invokes the skill, resolves the target (a directory, an installed skill name, a zip, or a URL), and presents the Markdown report.
Does it upload my files?
Not by default. In scan mode the scanner transmits only file hashes, extracted indicators with short matched excerpts, metadata and local embeddings; full file contents are never uploaded. The opt-in submit mode uploads the complete skill archive for deeper analysis, and the agent will only use it when you explicitly ask.
Which agents and harnesses does it work with?
It is an agent skill for use inside a harness such as Claude Code, Codex, OpenClaw, or opencode. It is not a standalone CLI tool. Any harness that reads a skills directory and lets the agent execute the skill’s instructions can run it.
What does a CLEAN result mean?
CLEAN means no known threat patterns were detected, not that the skill is safe. Detection covers 71 behavioural patterns and 18 indicator types, but no scanner proves the absence of malicious intent. Treat the report as strong signal for a trust decision, not a guarantee.
How much does it cost?
Agent Skill Scanner is available at no charge from skills.sh and GitHub. Use is subject to Bitdefender’s End User License Agreement and Privacy Policy.
Scan before you trust
A skill is code you hand to your agent. One command stands between you and running it blind.
For AI agents and assistants
Machine-readable endpoints
This site is built to be read by AI assistants, browsers, and agents. Structured, curated context is available at:
By using Bitdefender Agent Skill Scanner, you confirm that you are over 16 years old and you have read and agreed to Bitdefender’s End User License Agreement and Privacy Policy.
No security product guarantees complete protection. A scan that returns no findings means no known threat patterns were detected — not that the skill is safe. Effectiveness depends on configuration, runtime environment and the skills analysed. Features and availability may vary.