SkillHawk CLI
The SkillHawk static scanner finds dangerous instructions in SKILL.md, MCP configs and AGENTS.md and runs as a GitHub Action
- 70 ★ on the repository
- Last commit
- MIT
Minimal access
Why this level
- The scanner reads skill and config files as text and executes nothing, and calls GitHub when scanning a public repository
Install
- Works in
Manual install
git clone https://github.com/Berserk-hub150/skillhawk.git && cd skillhawk && node src/cli.js scan .Node.js is required. Output modes: --json and --sarif. A public repository can be scanned by link.
Access and checks
How we reviewMinimal accessThe tool runs nothing and makes no network calls.
- The scanner reads skill and config files as text and executes nothing, and calls GitHub when scanning a public repository
This is third-party code. Review the repository files before installing.
What it does
SkillHawk checks AI agent skills, MCP configurations and instructions without executing them. The node src/cli.js scan . command scans a folder or a public GitHub repository and returns findings with severity, rule ID, file, line, the matched instruction and a remediation tip. The summary includes a security score from 0 to 100 with a letter grade and a danger level. The SH001 to SH015 rules look for a remote script piped straight into a shell, encoded command execution, destructive file operations, access to passwords, keys and tokens, autostart and privilege escalation, suspicious outbound data uploads, chmod 777 permissions, prompt-injection style instructions, dynamic shell execution from code, remote code via Python exec and eval, and pipelines into Invoke-Expression. Output is available as JSON or SARIF for GitHub code scanning. The Berserk-hub150/skillhawk action plugs into a GitHub workflow in one step with a fail-on threshold. The repository also holds a 10-level teaching lab: you fix an unsafe SKILL.md in a fork and Actions grade it. A benchmark of 48 synthetic fixtures shows precision and recall of 93.75%.
Who it is for. Authors of skills and MCP configs, teams that accept outside skills and teachers who need hands-on practice in agent security.
Good fit when
- Before installing someone else skill you need to read its SKILL.md for hidden commands and key access
- In the CI of a skills repository a SkillHawk step blocks the merge on high severity findings
- Scan results go to GitHub code scanning through the SARIF format
- In a class or CTF students repair an unsafe skill in a fork and Actions grade it
- You need to quickly check a public repository by link without cloning it by hand
Not a fit when
- You need dynamic analysis or a sandbox: the scanner is static and runs nothing
- You need a safety guarantee: the benchmark shows two false positives and two misses over 32 malicious and 16 safe fixtures
- The target is ordinary application code: the rules aim at instructions for agents
- You need a certification: the lab Defender badge is called an educational artifact with no standing as a professional credential
Example request
Scan the skills folder with SkillHawk, show findings of high severity and above and suggest fixes without running any scriptsLimitations
- The analysis is static only: SkillHawk reports suspicious instructions and executes nothing.
- On a benchmark of 48 synthetic fixtures it gave 2 false positives and 2 misses, with precision and recall of 93.75%.
- The rule set is small: fourteen SH001 to SH015 rules that work on text patterns.
- Running it needs Node.js, the package is called skillhawk at version 0.2.1 with no runtime dependencies, and it runs from a cloned repository with node src/cli.js.
- Scanning public repositories needs network access.
- The Defender badge and Hall of Defenders in the lab are meant as educational material. The license is MIT.
How to disable. For local use deleting the cloned skillhawk folder is enough. The GitHub action is removed by deleting .github/workflows/skillhawk.yml, and lab forks are deleted in the repository settings as usual.
FAQ
How do I check a skill with SkillHawk?
Clone the repository and run node src/cli.js scan <path> for a folder or node src/cli.js scan <GitHub repository link> for a public repository. Output modes are --json and --sarif.
How do I add the scanner to CI?
Add a uses: Berserk-hub150/skillhawk@v0.2.1 step to a GitHub workflow with the path and fail-on parameters, for example fail-on: high.
What exactly do the rules look for?
Remote scripts piped to a shell, encoded execution, destructive commands, key access, autostart, privilege escalation, data uploads, chmod 777 and prompt-injection style instructions.
Does SkillHawk run the scripts it checks?
No, the analysis is purely static: the scanner reads instructions and scripts as text and runs nothing.
What is the Security Lab?
A teaching lab of 10 levels: you fork the repository, fix an unsafe SKILL.md and GitHub Actions grade it automatically and advance your progress up to level 10.
Discussion
No questions or reviews yet.
Related
CLI toolsA security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
Security scanner for agent skills and MCP servers: finds prompt injection, data exfiltration and supply chain risks before install
ClawScan runs several security scanners on agent skills and hands their results to a judge for a combined verdict.
A Claude Code skill scanner checks the whole folder, not just SKILL.md, and installs a skill only after your decision.
A security scanner for AI agent skills: static analysis, LLM review and runs of suspicious skills in a Docker sandbox.
A Snyk CLI that discovers installed MCP servers, skills and agents on your machine and checks them for prompt injections and malicious payloads
README in short
The README opens with an invitation to take a 5-minute skill security challenge through a fork and describes the 10 lab levels and rewards. Next it shows scanner output on an unsafe skill, adding the GitHub action, a benchmark snapshot, a table of rules, local use and output modes, and ends with material for teachers.