skillsmith

Source / CLI / library on GitHub →

How it works

  1. Paste or point — drop a SKILL.md into the scanner, or give a GitHub URL.
  2. Scan — the static engine checks prompt-injection patterns (incl. paraphrases), exfiltration endpoints, droppers, obfuscated payloads and dependency advisories (OSV).
  3. Decide — get a verdict, plain-language findings and a security score. Optional: run the behavioral sandbox to see what an agent following the skill would do.

Works for humans in the browser, for machines via REST API & MCP server, and offline via the skillsmith-scanner CLI. Read the guides to understand the threat model.

Sign in to scan — free, 5 scans/day, syncs across your devices. Or upgrade to Pro (100/day for $5).

Sign in with GitHub Skip sign-in, get an anonymous key

Paste a Claude Agent Skill's SKILL.md below, or scan a GitHub link. We lint it and run a static security scan (prompt-injection phrasing, dangerous code patterns) — nothing is stored.

~/workspace/SKILL.md
⚠ Not 100% accurate — read before trusting a result

skillsmith is a static heuristic scanner. It never runs the code, it just pattern-matches. A CLEAN result means our current ruleset found nothing — it is not a guarantee the skill is safe. A skill can still be malicious in ways this scanner doesn't (yet) detect, and a HIGH result can be a false positive. Always read code you didn't write before running it, especially anything with a python_import.

Scan Output
Initialize skillsmith engine...
Awaiting payload injection.
✓ Safe Skills Database refresh →

Skills that scanned CLEAN before, by anyone. Automated heuristic result only — not a manual audit. See the disclaimer above.

Loading…
⚡ API & Pricing Docs →
Free
5 scans
5 lookups / day
★ Pro
100 scans
150 lookups $5/30d
✦ Premium
Unlimited
everything $10/30d

One account, any device. Sign up to get an API key. Pay in USDC on Solana, no subscription surprises. Quota is shared across your devices. 

curl -X POST https://skillsmith.ch/api/signup
→ {"api_key": "sk_...", "free_daily_limit": 5}

curl -X POST https://skillsmith.ch/api/scan \
  -d '{"api_key":"sk_...","text":"..."}'

curl "https://skillsmith.ch/api/lookup?sha256=...&api_key=sk_..."
curl "https://skillsmith.ch/api/registry?api_key=sk_..."

# Pro ($5, 100 scans+150 lookups/day) or Premium ($10, unlimited), then:
curl -X POST https://skillsmith.ch/api/scan_pro \
  -d '{"api_key":"sk_...","tier":"premium","activate_payment_signature":"<tx>"}'

Full docs: /api-docs.html or the README on GitHub

Full API reference →