Releases·Tool Release
Open-source Skill Installer adds 3-stage security pipeline for Claude Code agent tools
A developer team built and open-sourced Skill Installer, a three-stage pipeline that filters agent tools and skills before they enter Claude Code and similar autonomous agent environments. It addresses tool-sprawl context degradation and the security risk of running unvetted community scripts with full terminal and filesystem permissions. The tool was tested across Claude Code, Hermes, and Antigravity.
4 engagement1 sourceSat, Sep 19, 2026, 03:39 AM
AI Overview
- Reddit user builds open-source Skill Installer, a 3-stage verification pipeline for agent tools and skills tested across Claude Code, Hermes, and Antigravity
- Semantic redundancy gate rejects tools with >80% overlap to prevent context token bloat degrading tool selection accuracy
- Pre-flight security gate uses AST and pattern scanning, with NVIDIA SkillSpector support, to detect reverse shells, credential exfiltration, and prompt injection
- Sandboxed git persistence auto-commits verified skills so tools survive container and workspace rebuilds
Related
Developments·Paper
SkillGate paper proposes runtime detection of malicious skill files in coding agents
A new arXiv paper introduces SkillGate, a cost-efficient runtime detector for malicious skill files in AI coding agents like Cursor, Claude Code, and GitHub Copilot. It targets the supply-chain risk of skill files installed via commands like npx skills add, which can exfiltrate credentials or inject backdoors. The approach aims to flag malicious Markdown-based skills without heavy overhead.
A new arXiv paper introduces SkillGate, a cost-efficient runtime detector for malicious skill files in AI coding agents like Cursor, Claude Code, and GitHub Copilot. It targets the supply-chain risk of skill files installed via commands like npx skills add, which can exfiltrate credentials or inject backdoors. The approach aims to flag malicious Markdown-based skills without heavy overhead.
0 engagement1 sourcearxivTue, Jul 28, 2026, 11:50 AM
Products·launched
SkillShield: pre-flight validator for third-party Ollama agent skills
SkillShield is a free open-source tool that statically scans and validates third-party skill packages for local agentic workflows using Ollama. It checks for prompt injection, pre-install risks, and excessive access before running skills locally, solving the security problem of untrusted community skills.
SkillShield is a free open-source tool that statically scans and validates third-party skill packages for local agentic workflows using Ollama. It checks for prompt injection, pre-install risks, and excessive access before running skills locally, solving the security problem of untrusted community skills.
1 engagement1 sourceredditMon, Jul 27, 2026, 11:41 AM
Products·building
skill-audit: open-source skill that audits agent skills before install
An open-source SKILL.md playbook plus offline Python checker that audits other agent skills before installation. It flags typosquats, prompt injection in SKILL.md, dangerous script patterns, and install vectors, then scores a verdict. It addresses supply-chain risks in agent skill marketplaces, motivated by the Snyk ToxicSkills findings.
An open-source SKILL.md playbook plus offline Python checker that audits other agent skills before installation. It flags typosquats, prompt injection in SKILL.md, dangerous script patterns, and install vectors, then scores a verdict. It addresses supply-chain risks in agent skill marketplaces, motivated by the Snyk ToxicSkills findings.
1 engagement1 sourceredditSat, Sep 26, 2026, 12:55 PM
Releases·Tool Release
SkillShield: Open-source static analysis tool for LangChain tool security
A developer released SkillShield, an open-source static analysis tool that scans LangChain agent tools and skills for malicious code, prompt injections, and excessive permissions before installation. It parses SKILL.md manifests and repository contents to catch hidden bash scripts and other risks, addressing the challenge of vetting third-party tools from open-source repos.
A developer released SkillShield, an open-source static analysis tool that scans LangChain agent tools and skills for malicious code, prompt injections, and excessive permissions before installation. It parses SKILL.md manifests and repository contents to catch hidden bash scripts and other risks, addressing the challenge of vetting third-party tools from open-source repos.
1 engagement1 sourceredditTue, Jul 28, 2026, 09:39 AM
Social·Community
Developer questions skills.sh security for production use, builds Agent Facets
A developer praises Vercel's skills.sh for discovering and installing skills into coding agents but expresses discomfort using it in production. They built an open-source project called Agent Facets to address the problems they encountered, sparking discussion about similar experiences.
A developer praises Vercel's skills.sh for discovering and installing skills into coding agents but expresses discomfort using it in production. They built an open-source project called Agent Facets to address the problems they encountered, sparking discussion about similar experiences.
11 engagement1 sourceredditMon, Aug 17, 2026, 06:20 PM