SkillWard CLI
A security scanner for AI agent skills: static analysis, LLM review and runs of suspicious skills in a Docker sandbox.
- 146 ★ on the repository
- Last commit
Broad access
Why this level
- Suspicious skills execute in a sandbox, and an isolation flaw is dangerous for the host.
- The scanned skill content and your key go to the model provider.
Install
- Works in
Manual install
git clone https://github.com/Fangcun-AI/SkillWard.gitThen in the folder: `pip install -r requirements.txt && pip install -e ./skill-scanner`. The sandbox needs `docker pull fangcunai/skillward:amd64` (or `arm64`) and the model key goes into `guardian-api/.env`.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Suspicious skills execute in a sandbox, and an isolation flaw is dangerous for the host.
- The scanned skill content and your key go to the model provider.
This is third-party code. Review the repository files before installing.
What it does
SkillWard checks a skill before publishing or installing in three stages. First YARA rules and regular expressions look for known signs (credential theft, code injection, hidden files, obfuscation). Then a model judges intent and unclear cases go to a Docker sandbox. In the container an agent runs the whole skill under a Guard monitor, with honeypot decoys of fake secrets nearby. The report holds logs, findings per stage, evidence and remediation advice. It works as the `guardian.py` CLI and as a web interface.
Who it is for. Security teams and skill catalogue maintainers who vet third-party skills before they reach working agents.
Good fit when
- A third-party skill needs vetting before it joins a corporate catalogue.
- A folder of skills is scanned in a batch with four parallel workers.
- A suspicious skill must run in isolation so its network calls show up.
- A skill author wants a report before publishing.
Not a fit when
- There is no Docker or model key: the sandbox stage and LLM review will not run.
- Skill content must not go to an external model provider.
- You need a safety guarantee: the scanner lowers risk but proves nothing clean.
Example request
Scan the `./incoming` skills folder in pre-scan mode and show findings per skill with evidence.Limitations
Python 3.10, Docker for the sandbox and a model provider key in `guardian-api/.env` are required. Skill content goes to the chosen model, and Guard monitoring is set up through a separate API address, so check the options in the documentation. Suspicious code runs in a container but is best kept on a separate machine. Licence markers in the repository disagree (Apache-2.0 in the README, `NOASSERTION` on GitHub). The last commit dates from July 2026.
How to disable. Delete the cloned repository and the `fangcunai/skillward` Docker image, and erase the `guardian-api/.env` file with the key separately.
FAQ
How does the quick mode differ from the full one?
`--stage pre-scan` runs only the static check and LLM review. The sandbox runs in the `runtime` stage and needs a Docker image.
Which models are supported?
`LLM_PROVIDER` accepts openai, anthropic, gemini, deepseek, qwen, xai, openrouter, mistral and ollama among others.
What are the sandbox decoys?
Pre-planted fake credentials and files. If a skill reads them or sends them out, that becomes evidence in the report.
Is there a web interface?
Yes, the `guardian-ui` folder holds an interface for single and batch scans, and a demo is available on the project site.
Does Guard need the project's own service?
The Guard API address is set in `guardian-api/.env` and there are three options, described in the configuration docs. Pick the one that keeps data where you need it.
Discussion
No questions or reviews yet.
Related
CLI toolsA security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
Security scanner for agent skills and MCP servers: finds prompt injection, data exfiltration and supply chain risks before install
ClawScan runs several security scanners on agent skills and hands their results to a judge for a combined verdict.
The SkillHawk static scanner finds dangerous instructions in SKILL.md, MCP configs and AGENTS.md and runs as a GitHub Action
The SecKnowledge skill loads a web-vulnerability and AI-app risk knowledge base into an agent for security testing of a target.
Rust OS-level sandbox and MCP server for agent skills: process isolation, install-time scanning and self-evolution
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| SkillWard (this card) | no | 146 | |
| Skill Scanner | no | 2,724 | statically analyses a skill; SkillWard adds LLM review and a Docker run with decoys |
| MCP Scanner | yes | 1,117 | checks MCP servers; SkillWard targets agent skills and confirms findings at runtime |
README in short
An opening quote about disagreement between scanners starts the description. Then come the three stages, the interface, results on five thousand skills and a quick start with image installation.