An agent skill is code
you run without reading.
You read the contract before you deploy it. Read the skill before you install it.
A config file that installs in one line can open a shell, read your credential store and post it somewhere — and none of that is visible in a rendered README. This checks for 21 patterns that are dangerous by construction. It is not a contract audit and it says so on every result.
Paste the file
An mcp.json, a SKILL.md, a claude_desktop_config.json, a settings file — whatever you are about to install. Free, no account, and nothing is stored: the text is read, matched and dropped. No row, no cache, no log line carrying it.
The filename decides which rules run — configuration-only rules do not fire on prose that merely quotes them. Up to 128 KB here; for a whole directory run npx saferico skill <path>, which applies the same rules locally and uploads nothing.
This is not a contract audit
It matters enough to say before anything else, because the two live on the same site and a screenshot of one must not be mistaken for the other.
The Solidity engine
201 detectors over a language with a specification and a type system, where "this function moves money and anyone can call it" is a decidable property. It emits a score.
This scanner
21 rules — 6 of them critical — matching patterns in prose and JSON. What makes a skill dangerous is intent, and intent is not decidable. It emits pass / warn / fail and deliberately no score.
What a pass means
That none of these patterns were present. Not that the file is safe to run. A skill can be hostile without matching anything known. Read what you install.
What it looks for
Things that are dangerous by construction — where the danger is in the shape of the config, not in a judgement about somebody's motives.
Execution
A shell as an MCP command. A download piped straight into a shell. Recursive deletes rooted at / or ~. Sandboxes and permission prompts switched off by flag. Executables referenced out of temp directories anything on the machine can rewrite.
Credentials
Live API keys and private key material committed into a file that gets shared and installed. Instructions pointing the agent at ~/.ssh, ~/.aws or .env — which, next to any outbound capability, is a complete exfiltration path.
Exfiltration
Throwaway collector endpoints. Chat webhooks shipped inside a config, which are write credentials in a URL. Instructions to send file contents, the environment or the conversation to a remote address.
Prompt injection
Instruction overrides. Identity reassignment. Imperatives hidden in HTML comments, invisible in a rendered view and fully visible to the model. Zero-width and bidirectional-override characters, so that what a reviewer reads and what the model receives are two different documents.
Permissions
Wildcard command grants, where the allowlist stops being an allowlist. Instructions telling the agent to act without confirming — which is precisely the state an injected instruction needs to be useful.
Supply chain
Unpinned packages installed and executed on every start. Code fetched from a branch rather than a commit, so the reviewed content and the executed content can differ by one push.
Run it where the files are
This page reads one file at a time. The same rules ship in the CLI, which walks a directory, needs no API key, and sends nothing anywhere.
The scan_agent_config MCP tool exposes the same rules to an agent that is about to install something — so the check happens before the file is trusted, not after.