# Agent Skill Scanner

_Supply-chain security for agent skills_

Canonical: https://bitdefender.ai/skill-scanner  
Last updated: 2026-08-25  
Status: available (https://www.skills.sh/bitdefender/agent-skill-scanner and https://github.com/bitdefender/agent-skill-scanner)

## Quick answer

Agent Skill Scanner is a Bitdefender agent skill that audits another agent skill before you install or trust it. It walks every file, runs 71 behavioural detectors across 16 threat categories, extracts 18 indicator types, and returns an LLM-generated report with a risk level, summary and per-file findings. Install it with "npx skills add bitdefender/agent-skill-scanner", from GitHub, or as a zip archive.

## What is Agent Skill Scanner?

Agent skills are executable code plus natural-language instructions that run with your agent’s privileges. A single malicious or careless skill can exfiltrate secrets, open a reverse shell, mine cryptocurrency, phone home, or hide a delayed trigger. Agent Skill Scanner audits a skill before you trust it: it walks every file, extracts security indicators, runs behavioural detectors, and returns an LLM-generated security report with a risk level, a summary, and per-file findings.

| Attribute | Value |
| --- | --- |
| Type | Agent skill, runs inside your harness |
| Works in | Claude Code, Codex, OpenClaw, opencode, and similar |
| Requires | Python 3.12 or 3.13 |
| Detection | 71 behavioural detectors, 16 threat categories |
| Indicators | 18 indicator types extracted per text file |
| Get it from | skills.sh · GitHub · zip archive |

## How to install

Agent Skill Scanner installs in under a minute with npx via skills.sh, by cloning the GitHub repository, or as a zip archive you drop into your skills directory. It runs inside your agent harness and installs its own Python dependencies on first use.

Works in: Claude Code, Codex, OpenClaw, opencode, Hermes Agent, and similar harnesses.

1. **With npx, from skills.sh (recommended):**

   ```
   npx skills add bitdefender/agent-skill-scanner
   ```

2. **From GitHub:** clone https://github.com/bitdefender/agent-skill-scanner and copy the inner `agent-skill-scanner/` folder into your skills directory (e.g. `~/.claude/skills/`).

3. **As a zip archive:** download https://github.com/bitdefender/agent-skill-scanner/archive/refs/heads/master.zip, unzip it, and move the inner `agent-skill-scanner/` folder into your skills directory.

Then paste this prompt into your agent:

```
Scan the <skill name or path> skill for security risks and show me the report.
```

_Requires Python 3.12 or 3.13 (3.13 recommended). Dependencies install on first use, and optional pieces degrade gracefully: .7z/.rar support, embeddings and signed-update verification each activate only when needed. Scanning .rar targets additionally needs a system unrar or unar binary on your PATH._

To uninstall, delete the agent-skill-scanner folder from your skills directory.

## What it detects

Agent Skill Scanner runs 71 behavioural detectors across 16 threat categories, including code execution, obfuscation, reverse shells, crypto-mining, persistence, time bombs and stealth natural-language directives. It also extracts 18 indicator types from every text file: URLs, IPs, base64 blobs, dangerous shell commands, secret env-var names and invisible Unicode characters among them.

| Threat category | Examples |
| --- | --- |
| Code execution | eval/exec, dynamic __import__, JS Function(), PowerShell Invoke-Expression |
| Subprocess usage | shell=True, os.system, os.popen |
| Obfuscation | base64-decode-then-exec, hex decoding, chr() construction, known encoded payloads |
| Network | requests/httpx/urllib, raw sockets, fetch(), connections to raw IPs |
| File operations | writes, deletions, bulk shutil ops, destructive rm -rf |
| Crypto-mining | xmrig, stratum, mining-pool indicators |
| Reverse shells | /dev/tcp, nc -e, bash -i >&, pty.spawn |
| Download-and-execute | curl … | sh, pip/npm install from URL, npx without approval |
| Credential access | bulk environment-variable harvesting |
| System persistence | cron, systemd, launchd, Windows registry run-keys |
| Privilege escalation | sudo, dangerous chmod, chown root, writes to system paths |
| Path traversal | ../../.., URL-encoded traversal |
| Telemetry | analytics and tracking SDKs, sendBeacon, phone-home |
| Symlink attacks | ln -s, os.symlink, Node fs.symlink |
| Time bombs | date and timestamp-comparison triggers, delayed execution |
| Stealth directives | natural-language exfiltration, covert-action and hidden-memory instructions |

18 indicator types are extracted from every text file: URLs, IPv4 addresses, data/javascript: URIs, emails, base64 blobs (decoded and inspected), percent-encoded URLs, environment-variable references, 25 dangerous shell commands, sensitive file paths, suspicious imports, private/loopback IPs, crypto-wallet addresses, known secret env-var names, paste-service domains, DNS-exfiltration patterns, and invisible Unicode characters.

Structural checks cover hidden dotfiles, package install-hooks (preinstall/postinstall, setup.py cmdclass), per-file SHA-256 and MD5 hashing, and a normalized skill-level hash used for report caching.

## Built for how skills actually hide things

### Layered analysis

Local indicator extraction feeds a server-side LLM that produces the report: a risk level, a plain-language summary, and per-file findings. Enough to decide, without wading through raw indicators.

### Deep archive inspection

The scanner recursively unpacks .zip, .tar.gz, .tar.bz2, .tar, .7z and .rar up to 10 levels deep, with limits of 500 MB uncompressed and 10,000 entries per archive. It skips symlinks rather than following them.

### Prose-aware detection

Natural-language threats hidden in SKILL.md instructions (stealth exfiltration, covert actions, keyword and counter triggers) are first-class detections.

### Semantic embeddings

The scanner computes local sentence embeddings (all-MiniLM-L6-v2, ONNX) to support the analysis. They run on your machine, and you can disable them.

### Privacy-respecting default

In scan mode the scanner transmits only hashes, extracted indicators and metadata; full files are never uploaded. Full-archive upload happens only in the explicit, opt-in submit mode.

### Flexible targets

Scan a directory, an installed skill by name, a .zip archive, or a URL. The skill resolves whatever you refer to in plain language.

## How a scan works

You ask in plain language, “scan the foo skill for security risks”, and the skill does the rest. There is no separate command-line tool to learn.

1. **Resolve** — The scanner resolves the target (a directory, an installed skill name, a zip, or a URL) into a skill root.
2. **Pack & hash** — It packs the skill into a normalized archive and computes a skill-level SHA-256, then checks for a cached report before repeating any work.
3. **Collect & enrich** — It walks, hashes and recurses into every file, then runs all 18 indicator extractors and 71 behavioural patterns over the text content.
4. **Embed** — It computes semantic embeddings on your machine, unless you disable them.
5. **Submit metadata** — Hashes, indicators with short matched excerpts, counts, metadata and embeddings go to the backend. In scan mode it sends no full file contents.
6. **Report** — The backend returns a risk level, summary and findings, rendered as Markdown in your session.

## What leaves your machine

Two modes, both agent-driven. Scan is the default: only hashes, extracted indicators and metadata are transmitted, and full files are never uploaded. Submit is opt-in: the complete skill archive is uploaded for deeper analysis, and only when you explicitly ask for it.

| Mode | Transmitted |
| --- | --- |
| Scan (default) | File hashes (SHA-256/MD5), extracted indicators and pattern matches — including short excerpts of matched content (regex fragments ≤100 chars, decoded base64 snippets ≤500 chars) — file metadata, finding counts, SKILL.md frontmatter, dependency metadata, and local embeddings. Full file contents are not transmitted. |
| Submit (opt-in) | The complete skill archive, uploaded for deep analysis. The agent will not do this unless you explicitly ask. |

**The contract the agent is held to:**
- Scan mode is the default: a casual request never uploads your files.
- Submit is opt-in only: the agent won’t upload the full archive unless you explicitly ask.
- The agent relays, it doesn’t overrule: it presents the backend’s report and never substitutes its own verdict.
- Errors are surfaced as they are: on failure you get the specific reason.
- Self-updates are Ed25519-signature-verified against a key pinned in the client, staged with path-traversal-safe extraction, and rolled back automatically on failure.

> A scan that returns no findings means no known threat patterns were detected — not that the skill is safe.

## What you can point it at

The scanner accepts four target types: a directory, an installed skill name, a zip archive, or a URL.

| Target | Behaviour |
| --- | --- |
| Directory path | Scanned directly as the skill root. |
| Skill name | Resolved via the harness’s known skill directories, project- and user-level. |
| .zip archive | Extracted to a temp directory, then scanned. |
| URL | Sent to the backend for scanning (scan mode only). |

## Built by Bitdefender

Agent Skill Scanner is made by Bitdefender, the company that has protected people and organisations since 2001. The figures and recognitions below describe Bitdefender the company — not the scanner itself.

| Statistic | Value |
| --- | --- |
| threats blocked every year | 50B+ |
| technology patents | 580+ |
| countries protected | 170+ |
| years of AI-driven security | 15+ |
| of employees work in R&D | 50%+ |
| law-enforcement partnerships | 30+ |

**Trusted by Ferrari as cybersecurity partner** — A partnership born from a passion for high performance and technological innovation — Bitdefender supports Ferrari with Advanced Threat Intelligence to improve detection and response to cyber threats. (https://www.bitdefender.com/en-us/scuderiaferrari/)

**Award-winning security software you can trust. Always.** — Consistently top-ranked by the world’s leading independent testing labs and tech publications. (https://www.bitdefender.com/en-us/trusted/)

- PCMag Best of 2026
- Gartner Peer Insights Customers’ Choice 2026
- AV-TEST certified
- Forrester Wave Strong Performer, XDR
- AV-Comparatives approved

**Heritage** — AI in cybersecurity since 2008 — 70+ academic papers and 50+ researchers behind Bitdefender's AI.

## Frequently asked questions

### What is Agent Skill Scanner?

Agent Skill Scanner is a Bitdefender agent skill that audits other agent skills before you install or trust them. It runs 71 behavioural detectors across 16 threat categories, extracts 18 indicator types from every file, and returns an LLM-generated security report with a risk level, summary, and per-file findings.

### How do I install Agent Skill Scanner?

Three ways: run “npx skills add bitdefender/agent-skill-scanner” via skills.sh; clone the GitHub repository and copy the agent-skill-scanner folder into your skills directory; or download the zip archive and unzip it there. It requires Python 3.12 or 3.13 and installs its own dependencies on first use.

### How do I scan a skill?

Ask your agent in plain language, for example “scan the foo skill for security risks”. There is no separate command to learn: the harness invokes the skill, resolves the target (a directory, an installed skill name, a zip, or a URL), and presents the Markdown report.

### Does it upload my files?

Not by default. In scan mode the scanner transmits only file hashes, extracted indicators with short matched excerpts, metadata and local embeddings; full file contents are never uploaded. The opt-in submit mode uploads the complete skill archive for deeper analysis, and the agent will only use it when you explicitly ask.

### Which agents and harnesses does it work with?

It is an agent skill for use inside a harness such as Claude Code, Codex, OpenClaw, or opencode. It is not a standalone CLI tool. Any harness that reads a skills directory and lets the agent execute the skill’s instructions can run it.

### What does a CLEAN result mean?

CLEAN means no known threat patterns were detected, not that the skill is safe. Detection covers 71 behavioural patterns and 18 indicator types, but no scanner proves the absence of malicious intent. Treat the report as strong signal for a trust decision, not a guarantee.

### How much does it cost?

Agent Skill Scanner is available at no charge from skills.sh and GitHub. Use is subject to Bitdefender’s End User License Agreement and Privacy Policy.

| Attribute | Value |
| --- | --- |
| Analyses | Agent skills |
| Status | Available — skills.sh & GitHub |
| Requires | Python 3.12 or 3.13 |
| Made by | Bitdefender |

## Related

- [Bitdefender AI Guardian](https://bitdefender.ai/): the flagship agent-security product
- [GitHub repository](https://github.com/bitdefender/agent-skill-scanner)
- [skills.sh listing](https://www.skills.sh/bitdefender/agent-skill-scanner)
- [All context](https://bitdefender.ai/llms-full.txt)

## Legal

By using Bitdefender Agent Skill Scanner, you confirm that you are over 16 years old and you have read and agreed to Bitdefender’s End User License Agreement and Privacy Policy. ([End User License Agreement](https://www.bitdefender.com/en-us/site/view/subscription-agreement-and-terms-of-services-for-home-user-solutions), [Privacy Policy](https://www.bitdefender.com/en-us/site/view/legal-privacy-policy-for-home-users-solutions))

No security product guarantees complete protection. A scan that returns no findings means no known threat patterns were detected — not that the skill is safe. Effectiveness depends on configuration, runtime environment and the skills analysed. Features and availability may vary.