GenCMS Guard

Check before your AI installs it.

Skill packages, MCP configurations, tool descriptions and agent-package source can contain risky instructions or permissions. Guard performs bounded static analysis before you decide whether to trust them.

Guard scanning package and connector evidence for reviewable risk signals
Try:

Guard reads the package — manifest, prompts, source, dependencies — and reports what it observes against 11 check families. Public GitHub repositories are fetched live; for private code, paste only the source or manifest you are permitted to analyse. ZIP upload is not enabled in this release.

Guard reports observed security signals. A low-risk result is not a guarantee of safety, and no result should replace your own review of code you intend to run.

Quick Scan

Scan a public GitHub repository or paste source text.

Skill Scan

Static analysis of a public Skill repository or supplied package text.

MCP Scan

Analyse a public MCP repository or pasted configuration and tool text.

Activity metadata

Signed-in workspaces can save scan outcome metadata when recording is enabled.

Guard endpoint

Call the public scan endpoint from a script or CI job.

Workspace policy

Retention and Guard recording controls work; risk thresholds and install blocking are planned.

What Guard checks

Eleven classes of signal, on every scan.

Bounded static pattern analysis over collected text, source, manifests and package declarations. Findings are grouped by what an attacker could do with them, not by file.

Execution and data access4 signal classes

  • Suspicious shell commands

    Command execution reachable from untrusted input.

  • Credential and secret access

    Reads of key files, environment secrets or token stores.

  • Network calls

    Outbound endpoints, including ones not declared in the manifest.

  • Filesystem access

    Reads and writes outside the declared working scope.

Prompts, packages and permissions5 signal classes

  • Prompt injection patterns

    Instructions embedded in data intended to steer a model.

  • Suspicious package files

    Install hooks, post-install scripts and unusual archive members.

  • Embedded binary indicators

    Compiled payloads shipped inside a text package.

  • Permission mismatch

    Behavior in the code that the manifest does not declare.

  • Risky tool declarations

    Tools granting broader capability than the Skill needs.

Dependencies and dangerous patterns2 signal classes

  • Dependency declarations

    Unpinned ranges and dependencies installed directly from Git URLs.

  • Known dangerous patterns

    Destructive commands, reverse-shell patterns and crypto-mining or wallet access.

Low RiskReview RecommendedHigh Risk

Guard never labels anything “guaranteed safe”. Results describe signals found in a specific version of a specific package at scan time.

Marketplace integration

Marketplace integration is planned.

A workspace can persist a Skill install record and its declared permissions. Executable packages, publishing and automatic scanning in a marketplace release path are not connected.

OfficialReviewedCommunityUnverified
Open the concept catalogue

Planned Skill lifecycle

  1. 1

    Package or GitHub submission

  2. 2

    Schema validation

  3. 3

    GenCMS Guard scan

  4. 4

    Permission analysis

  5. 5

    Automated tests

  6. 6

    Human review if required

  7. 7

    Publish

Permission model

Compare declared permissions with observed signals.

Guard can flag behavior that appears broader than a supplied permission declaration, and workspace install records persist those declarations. Executable installation and run-time permission enforcement remain product-preview designs.

web.fetch

Fetch public web pages

files.read

Read files you provide

files.write

Write output files

http.call

Call external HTTP endpoints

memory.read

Read selected Memory

memory.write

Write to Memory

api.call

Call GenCMS API endpoints

code.execute

Execute code in a sandbox

email.read — not in MVPemail.send — not in MVPcalendar.read — not in MVPcalendar.write — not in MVPshell — not in MVP

Guard access

Public scanning and workspace activity metadata are available.

Public scanner

Available

  • Public GitHub repository or supplied text
  • Risk score, evidence and recommended actions
  • No saved public history

Signed-in workspace

Available

  • Optional scan outcome metadata
  • Retention and recording settings
  • API keys with the guard:scan scope

Full report workflow

Planned

  • Saved report bodies and version comparison
  • Document export and shared reports
  • Policy thresholds, install controls and private ZIP upload
Open Guard workspace