Agent Skill Check

A clean result is not proof a skill is safe. These are static rules: a payload can sit behind a URL, inside a binary, or in wording no rule matches. Read every script before you install a skill from someone you do not know.

What it checks

1. Hidden charactersZero-width characters, bidirectional controls and Unicode tag characters that hide text from a human reader but not from the model.
2. Instructions aimed at the agentLines that tell the model to ignore earlier instructions, keep things from the user or act without asking.
3. Download and runcurl or wget piped into a shell, base64 decoded into a shell, PowerShell download-and-execute, and eval on fetched content.
4. Secrets plus networkReads of SSH keys, cloud credentials, .env files, browser data or the whole environment, especially in a skill that also sends data out.
5. Where data goesEvery outside domain the skill or its scripts contact, with paste sites, request catchers, tunnels and raw IP addresses flagged.
6. Safety switchesFlags and settings that turn off permission prompts, such as --dangerously-skip-permissions or bypassPermissions.
7. Persistence and damageWrites to shell profiles, crontab or launch agents, sudo, recursive deletes and world-writable permissions.
8. Remote instructionsText that tells the agent to fetch instructions from a URL and follow them, so the real payload lives somewhere the scan cannot see.
9. FrontmatterA name and description, descriptions written to trigger on everything, and broad allowed-tools grants.

Privacy: the check runs in your browser. With a GitHub link, the page reads the files straight from GitHub (up to 40 text files). Nothing is sent to X1Y1. Also see the MCP Config Check for the servers your agent runs.