Vetix CLI
A scanner for skill directories: rules find obvious signs and an AI analyst in a read-only filesystem catches disguised chains.
- 50 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- The contents of scanned skills go to a model, and the `examples/` directory holds deliberately malicious samples.
Install
- Works in
Manual install
go build -o vetix ./cmd/vetixBuild from a cloned repository on Go 1.25 or newer; prebuilt binaries are on the releases page.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The contents of scanned skills go to a model, and the `examples/` directory holds deliberately malicious samples.
This is third-party code. Review the repository files before installing.
What it does
Vetix checks skill directories for safety. Deterministic rules catch obvious signs, then a language model re-judges each hit against the real file content so the report is not drowned in false alarms. A separate behavioral analysis agent inside a read-only virtual filesystem traces the chain instruction, tool call, host impact and hunts for disguised commands, Base64 payloads, remote code loading, prompt injection, credential theft and persistence. `vetix -s <dir>` scans one skill or a parent directory, and `vetix -p claude-code` and `-p codex` scan every skill under those agent roots. Results are written to `report.json` under the directory hash. A repeat scan takes the report from cache, and tokens of every model call are recorded in the report.
Who it is for. Security engineers and developers who install third-party skills and want to filter out dangerous ones before an agent runs them.
Good fit when
- Before installing a hub skill you need to know whether it hides remote code loading
- The whole `~/.claude/skills` directory is scanned at once
- A report with token use is needed to estimate batch scan cost
- Rules raised a hit and it has to be dismissed or confirmed by file content
- A new rule plugin should be tested on several samples
Not a fit when
- You have no access to a language model: the analyst and re-check run through it
- You need a safety guarantee: the scanner lowers the chance of missing danger but does not prove absence of threats
- You want to run the `examples/` directory as normal skills: it holds deliberately malicious samples
Example request
Scan every skill in `~/.claude/skills` with Vetix and show a summary of dangerous findings and token use.Limitations
It needs a model configured in `config.yaml`, with a sample in `example.config.yaml`, and the contents of scanned files go to the chosen model. Building from source requires Go 1.25 or newer, and prebuilt binaries ship in releases along with a Docker image. The `examples/` directory contains deliberately malicious samples for tests and must not be installed or loaded outside a scanning environment. The report is cached by directory hash and engine fingerprint, so after upgrading Vetix or its rule set a full re-scan runs. LangSmith tracing is optional but, when enabled, writes agent runs to an external service.
How to disable. Delete the `vetix` binary and the Docker image. Saved reports live in `./output` or in the folder set with `-output-dir` and are deleted manually.
FAQ
How do I install Vetix?
Download a binary from the releases page or build with `go build -o vetix ./cmd/vetix` on Go 1.25 or newer. A Docker image is also available: `docker build -t vetix:latest .`.
How do I scan all Claude Code skills?
With `vetix -p claude-code`. For Codex use `-p codex` and point to any skills directory with `-s`.
What does model re-checking give?
Each rule hit is judged against the real file content, so high-recall rules do not flood the final report with false alarms.
Does the scanner change the scanned skills?
No. The agent reads files only inside the skill in a read-only virtual filesystem, symlinks are refused and writes are rejected at the backend.
How do I make it ignore the cache?
With the `-force` flag, which discards the saved report and runs a full re-scan.
Discussion
No questions or reviews yet.
Related
CLI toolsA security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
Security scanner for agent skills and MCP servers: finds prompt injection, data exfiltration and supply chain risks before install
ClawScan runs several security scanners on agent skills and hands their results to a judge for a combined verdict.
VibeSec
VibeSec-Skill
A secure coding skill: the agent looks at code from a bug hunter's perspective and prevents common web vulnerabilities
A Snyk CLI that discovers installed MCP servers, skills and agents on your machine and checks them for prompt injections and malicious payloads
A Claude Code skill scanner checks the whole folder, not just SKILL.md, and installs a skill only after your decision.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| Vetix (this card) | no | 50 | |
| Skill Scanner | no | 2,724 | the Cisco skill scanner; Vetix adds a behavioral analysis agent and model re-checking of hits |
| AgentGuard | no | 494 | checks agent actions before they run; Vetix scans the skills themselves beforehand |
README in short
The README lists features, command line flags, common commands, report caching, three install methods and rules for adding a plugin. A warning about malicious samples in `examples/` stands at the start.