Guard · Skill Scanner

Scan a Skill before it runs.

Point Guard at a public GitHub repository or paste relevant source and manifest text. It applies bounded static rules, compares permission declarations with observed signals and shows the evidence it matched.

Public GitHub URLPasted sourceManifest signalsPermission analysisPackage declarations
Try:

Guard reads the package — manifest, prompts, source, dependencies — and reports what it observes against 11 check families. Public GitHub repositories are fetched live; for private code, paste only the source or manifest you are permitted to analyse. ZIP upload is not enabled in this release.

Guard reports observed security signals. A low-risk result is not a guarantee of safety, and no result should replace your own review of code you intend to run.

Scope: up to 40 selected files, 96 KB per file, 1.5 MB total and a nine-second fetch timeout. Guard does not execute code, authenticate to private repositories, upload ZIP files or prove that a package is safe.

How a scan runs

Seven steps, one report.

Each step can fail independently. A failure downgrades the risk level rather than silently passing.

See every check
  1. 1

    Collect bounded public repository files or pasted text

  2. 2

    Prioritize manifests, entry points and package files

  3. 3

    Apply static rules to collected source and instructions

  4. 4

    Compare permission declarations with observed signals

  5. 5

    Inspect package hooks and dependency declarations

  6. 6

    Score and classify findings

  7. 7

    Return evidence and notes in the browser or JSON response