Is this agent skill safe to install?
Paste a SKILL.md, an MCP server config, or an agent settings file. 43 checks for remote code execution, hidden Unicode, prompt injection, secret theft and over-broad permissions. Everything runs in your browser; nothing is uploaded.
What each flag means: the full red-flag checklist
Heuristic, not a guarantee. A clean result means none of our patterns matched, not that the file is safe. Read anything that runs commands, and prefer skills from authors you trust.
What it checks
- Remote code: curl | sh, download-then-run, reverse shells, PowerShell iex, base64 decoded into a shell, eval.
- Hidden content: zero-width and text-direction Unicode, invisible tag characters, look-alike letters, instructions in HTML comments, long encoded blobs.
- Prompt injection: "ignore previous instructions", "don't tell the user", role hijacks.
- Data theft: reads of SSH keys / cloud credentials / .env, webhook and tunnel endpoints, raw-IP URLs, uploads.
- Damage & persistence: rm -rf ~, disk wipes, sudo, cron and shell-startup edits, git hooks.
- Permissions & settings: skipped permission prompts, hooks that run commands, API base-URL overrides, Bash(*), pre-approved shell/web/write tools.
- Secrets & supply chain: hardcoded API keys and private keys, unpinned npx -y / uvx packages, plain-HTTP downloads.
Deep review (coming)
Want a model to actually read the skill and explain what it does, step by step? We're considering a paid deep review (about $1 per file). It doesn't exist yet: if you'd pay for it, click below. We only count the click, nothing else.
Guide: 43 red flags to check before installing a skill or MCP server