AI skill scanner
Scan an AI skill before your agent runs it.
An AI skill is code plus instructions, installed from the internet, executed with your credentials and your data in scope. The npm supply-chain lesson applies exactly, with one addition: the instruction text is executable too.
Available now
Public Guard scans, optional workspace scan metadata and scoped Guard API keys.
Preview
Private ZIP upload, saved reports, comparisons, thresholds and automatic marketplace scanning.
Context
What makes a skill package different
Traditional package scanning looks at code and dependencies. A skill needs both of those plus a look at what its prompts tell the model to do.
The prompt is an attack surface. Text that tells a model to ignore prior instructions or print its context is a payload, not documentation.
Permissions are self-declared. A manifest saying web.fetch means nothing if the code also reads credential files.
Install hooks run before anyone reads the package, and obfuscated blobs make review impossible by design.
Hidden characters — zero-width, white-on-white, comment-buried — carry instructions a human reviewer will never see.
Evaluation
What a scan should actually report
A single risk number is marketing. These are the findings that let you make a decision.
Shell execution and runtime evaluation
Interpreters reached directly, eval on model output, or a remote script piped into a shell at install time.
Credentials and secrets
Committed keys, environment sweeps, and reads of ~/.ssh, ~/.aws/credentials, .npmrc or the keychain.
Prompt injection
Instruction override, requests to reveal system prompts or keys, and hidden or invisible instruction text.
Permission mismatch
Behaviour the code exercises that the manifest never declared — the gap between what you approve and what runs.
Package and binary signals
Install hooks, obfuscated payloads, vendored minified code and compiled artefacts inside a text package.
Evidence, not adjectives
The file, the line and the matched text for every finding, so you can confirm it yourself in under a minute.
GenCMS
GenCMS Guard
Eleven check families over the package, its manifest, its prompts and its dependencies. Free for public targets.
Scan a repository
Paste a public GitHub URL. Guard reads the manifest and source and reports what it finds, with the file each match came from.
Open Skill Scanner →Scan pasted content
Paste a manifest, source excerpt or tool listing directly. Guard analyses the supplied text without fetching another target.
Quick scan →Scan from CI
One POST to /api/v1/guard/scan, so a risky dependency fails the build instead of reaching production.
Guard API →Workspace install records
Save a Skill version, declared permissions and enabled status in a tenant-scoped workspace. Skill execution, publishing and automatic marketplace scanning are not implemented.
See Skills →Questions
Asked before you commit.
Is the scanner free?
Public quick scans are available without an account and are rate limited. Signed-in workspaces can save scan outcome metadata when enabled, and scoped API keys can call Guard. Private ZIP scanning, full report history, version comparison and policy thresholds are not implemented.
Does a Low Risk result mean the package is safe?
No, and Guard never says it does. A result describes signals found in one version of one package at one moment. It is an input to your review, not a replacement for it.
What does it do about false positives?
Every finding carries the file and the matched text. Matches found only in Markdown are reported one severity lower — except for prompt injection, credential and permission findings, where the prose is the payload.
Can I scan private code?
You can paste text directly into the scanner. Private ZIP upload and full saved report bodies are not implemented; signed-in history stores scan metadata only. Review sensitive material before sending it to any hosted service.
Check before your AI installs it.
Paste a repository URL and read the findings. No account needed.
GenCMS is a product of IGEARS TECHNOLOGY LIMITED. Guard results describe observed signals, not guarantees.