Local AI Skill Security Scanner

Local static security scan for AI agent skills to identify risks before use

Problem

The agent ecosystem is exploding with reusable skills, but no one knows if they are safe. Installing and using them directly may introduce data leaks, privilege escalation, and other risks. There is a lack of localized security audit tools.

Solution

A local CLI tool that performs static risk scanning on downloaded AI agent skill packages. It checks patterns like network requests, file access, command execution, and sensitive data reads, generates a risk report, and provides usage recommendations. Users can integrate it into their installation workflow.

Users

Developers and teams using AI agent skill packages, especially security-sensitive enterprise users

MVP

Parse skill package metadata and code; detect risk patterns like network requests, file read/write, command execution; generate risk-level reports; support batch scanning of local skill directories; output readable CLI reports and JSON

Revenue

Open-source core + paid enterprise edition (batch scanning, policy customization, CI integration)

Why now

The AI agent skill ecosystem is expanding rapidly, but security tools lag far behind; indie developers can quickly build static analysis rules without complex infrastructure