SkillWarden
Open source · Apache-2.0

Scan, lock, and gate your Agent Skills

The npm audit + lockfile + CI drift gate for the SKILL.md era. One command against prompt injection, rug-pulls, credential leaks, and hidden-Unicode smuggling.

Get startedGitHub
git clone https://github.com/wookat/skillwarden
skillwarden ci
$ skillwarden ci --fail-on high

✔ changelog-writer       3 files · matches lock
✔ code-reviewer          5 files · matches lock
⚠ web-helper            hidden-unicode: zero-width chars in SKILL.md
✖ deploy-buddy          prompt-injection: "ignore previous instructions"
✖ notes-skill           content drift from skillwarden.lock

2 gate failures · 1 warning · exit code 1
Gate closed. Review drift with `skillwarden diff`.

One loop, four gates

Everything fragmented across five point tools today, in a single coherent workflow.

scan

Deterministic, offline analysis: prompt injection, hidden Unicode, dangerous commands, credential leaks, exfiltration, obfuscated scripts.

lock

Pin every file of every approved skill (per-file SHA-256) into skillwarden.lock. Rug-pulls can’t hide.

gate

skillwarden ci fails on any drift from the approved baseline or findings at your severity threshold.

advise

Cross-check skills against a public, structured Agent Skills advisory database (SKA-YYYY-NNNN).

Gate your agent in three steps

  1. 1

    Install

    Clone and build; auto-discovers .claude/skills, .agents/skills, .codex/skills, and more.

  2. 2

    Scan & lock

    Audit every skill offline, then pin every file's SHA-256 into skillwarden.lock.

  3. 3

    Gate in CI

    Add one CI step (or the GitHub Action). Any upstream drift turns the build red.

terminal
# 1. install
$ git clone https://github.com/wookat/skillwarden
$ cd skillwarden && pnpm install && pnpm build

# 2. scan and lock
$ skillwarden scan
$ skillwarden lock

# 3. gate in CI
$ skillwarden ci --fail-on high

Six deterministic scan rules

Aligned with real-world skills-ecosystem threats — plus a public, structured Agent Skills advisory database. No account, no API key, no LLM, no network.

Rule reference
prompt-injectioncritical

“Ignore previous instructions”, concealment, fake system markers, precedence claims.

hidden-unicodecritical

Zero-width characters, bidi controls, and Unicode tag-block instruction smuggling.

exfiltrationhigh

Env secrets in network requests, ~/.ssh reads, dead-drop endpoints, ephemeral tunnels.