skillguard

SkillGuard is a security tool for people who install skills and MCP servers into coding agents. It scans those extensions before they are used, reports the evidence behind each finding, and can block risky or unreviewed tools on hosts that expose a suitable hook. What it checks The scanner looks for hidden instructions, credential theft, data leaks, unsafe downloads, destructive commands, obfuscation and persistence behavior. For MCP servers it adds structural checks: unsafe launch chains, plaintext credentials, suspicious endpoints, insecure transport and unpinned runtimes. Findings include file, location, severity and reason, so a human can make the final call. The project states plainly that findings support a decision rather than guaranteeing safety. How it works Discovery finds global, project and plugin skills plus configured MCP servers. Static scanning builds a redacted representation of an MCP server from its command, arguments, endpoint, environment-variable names and header names; it never launches the server. Secret values are read in memory only to spot inline credentials and are not written to findings, cache files or history. Results are normalized, cached as JSON for fast hook decisions, and stored in SQLite for scan history and optional activity records. Runtime protection On supported surfaces, each tool call is compared with the latest scan before it proceeds. Never-scanned, missing-cache, changed-since-scan and critical/high-finding targets are blocked until acknowledged; clean targets are allowed; explicitly skipped targets are allowed with a reminder. Claude Code can gate both skills and MCP tools. Codex can gate MCP tool calls after the installed hook is trusted, but Codex does not currently expose skill loading as a hook event. The MCP policy defaults to enforce and can be set to warn or off, with an environment variable override for a single process. Interfaces and installation Claude Code users install it as a plugin from the marketplace. Codex and terminal users install through a shell script and add the Codex plugin. An editable Python install exposes the skillguard and skillguard-hook entry points. Repository adapters install guidance for 13 agent surfaces including Cursor, Windsurf, Gemini CLI, GitHub Copilot coding agent, Jules, Aider, goose, opencode, Zed, Warp and Junie; those adapters provide workflow guidance rather than automatic enforcement unless the host offers an equivalent hook. Engines The required dependency list is intentionally empty. The local engine is offline and deterministic. The MCP structural engine applies automatically to MCP targets. Optional engines add Cisco AI Skill Scanner rules, SkillAudit remote analysis, or Snyk agent-scan semantic analysis; each sits behind an availability check and degrades to a reported skip when its dependency, token or network access is missing. Selecting a remote engine can send scan material to that provider, and live MCP introspection launches or contacts a server, so both are explicit opt-in choices. Review workflow Commands cover an inventory scan, a terse cached-risk summary, interactive target-by-target review, per-target timelines, history and activity views. Reviewed findings can be acknowledged, marked as false positives, or skipped with a visible reminder. A review disposition is cleared when a new scan changes the evidence it covered, and the documentation stresses re-scanning after installing, updating or editing extensions. Privacy and testing The tool is local-first: the local engine, MCP structural engine, verdict cache, triage files and SQLite history stay on the machine. The test suite treats the scanner as a security boundary, covering malicious and innocent fixtures, true-positive/false-positive pattern pairs, Unicode obfuscation and output spoofing, cache corruption and staleness, MCP redaction and secret non-persistence, and integration packaging. The README reports 313 passing tests for the snapshot it describes. Licensing SkillGuard is dual-licensed under AGPL-3.0-only or a separate commercial license. Running the unmodified scanner personally or at work does not require the commercial license; that option applies when building on or distributing the software under different terms.