SkillSentry

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks before installing agent skills.

Features

• 5 analyzers, ~20 vulnerability patterns across 5 categories
• AST-based detection for dangerous Python calls (exec, eval, subprocess)
• Regex pattern matching for prompt injection, data exfiltration, privilege escalation, and supply chain risks
• Risk scoring: 0-100 score with severity labels and recommendations
• Multiple output formats: Terminal (Rich), JSON, Markdown
• Minimal dependencies: Only 3 runtime packages (typer, rich, pyyaml)

Quick Start

cd skillsentry

# Create virtual environment
python -m venv .venv && .venv\Scripts\activate

# Install
pip install -e .

# Scan a skill directory
skillsentry scan ./test_samples/safe_skill/
skillsentry scan ./test_samples/malicious_skill/

# JSON output
skillsentry scan ./test_samples/malicious_skill/ --format json --output report.json

# Markdown output
skillsentry scan ./test_samples/malicious_skill/ --format markdown --output report.md

Vulnerability Patterns

Prompt Injection (P1-P4)

ID	Pattern	Severity
P1	Instruction Override	HIGH
P2	Hidden Instructions	HIGH
P3	Exfiltration Commands	HIGH
P4	Behavior Manipulation	MEDIUM

Data Exfiltration (E1-E4)

ID	Pattern	Severity
E1	External Transmission	MEDIUM
E2	Env Variable Harvesting	HIGH
E3	File System Enumeration	MEDIUM
E4	Context Leakage	HIGH

Privilege Escalation (PE1-PE3)

ID	Pattern	Severity
PE1	Excessive Permissions	MEDIUM
PE2	Sudo/Root Execution	MEDIUM
PE3	Credential Access	HIGH

Dangerous Code (AST1-AST5)

ID	Pattern	Severity
AST1	exec() call	CRITICAL
AST2	eval() call	HIGH
AST3	Dynamic import()	HIGH
AST4	subprocess call	HIGH
AST5	os.system / exec-family	HIGH

Supply Chain (SC1-SC3)

ID	Pattern	Severity
SC1	Unpinned Dependencies	LOW
SC2	External Script Fetching	HIGH
SC3	Obfuscated Code	HIGH

Risk Scoring

Score	Severity	Recommendation
0-20	LOW	SAFE
21-50	MEDIUM	CAUTION
51-80	HIGH	DO NOT INSTALL
81-100	CRITICAL	DO NOT INSTALL

Architecture

skillsentry/
├── cli.py              # Typer CLI entry point
├── scanner.py          # Sequential scan pipeline
├── models.py           # Finding, Severity, Location, risk scoring
├── input_handler.py    # Resolve input to local directory
├── context_builder.py  # Walk files, build cache, parse manifest
├── report.py           # Terminal/JSON/Markdown formatters
└── analyzers/
    ├── base.py                 # BaseAnalyzer + shared utilities
    ├── prompt_injection.py     # P1-P4
    ├── data_exfiltration.py    # E1-E4
    ├── privilege_escalation.py # PE1-PE3
    ├── dangerous_code.py       # AST1-AST5 (Python AST)
    └── supply_chain.py         # SC1-SC3

License

MIT