Enkrypt AI Skill Sentinel

A security scanner for Agent Skill packages. Skill Sentinel uses multi-agent AI analysis to detect prompt injection, data exfiltration, command injection, malware, and other threats hiding in skill packages for Cursor, Claude Code, Codex, and OpenClaw.

Agent Skills extend AI coding assistants with custom instructions and scripts — but they also create a new attack surface. A single malicious skill can steal credentials, inject hidden prompts, exfiltrate code, or execute arbitrary commands. Skill Sentinel catches these threats before they reach your agent.

Cursor

Claude Code

Codex

OpenClaw

and other agents

Specialized agents work together to analyze Skills from multiple angles — manifest inspection, file verification, cross-referencing, and threat correlation.

Automatic VirusTotal integration scans binary files (executables, archives, PDFs) for known malware before any LLM analysis begins.

Reads complete file contents without arbitrary cutoffs — catching malicious instructions hidden deep in documentation where other scanners stop looking.

Detects sophisticated attacks that span multiple files by tracking data flows and verifying that script behavior matches documented claims.

Purpose-built for prompt injection, command injection, credential theft, and other threats specific to AI coding assistants.

Scan entire directories of Skills concurrently with organized reports — audit all your Cursor, Claude Code, Codex, and OpenClaw Skills in one command.

Requires Python >= 3.10, < 3.14.

pip install skill-sentinel

Or using uv (recommended):

uv pip install skill-sentinel

For development or local modifications:

# Clone the repository
git clone https://github.com/enkryptai/skill-sentinel.git
cd skill-sentinel

# Install with uv (recommended)
uv venv --python 3.13 .venv
source .venv/bin/activate
uv pip install -e .

# Or install with pip
pip install -e .

# 1. Export your OpenAI API key
export OPENAI_API_KEY="sk-..."

# 2. (Optional) Export your VirusTotal API key for binary malware scanning
export VIRUSTOTAL_API_KEY="your-vt-api-key"

# 3. Scan a skill directory
skill-sentinel scan /path/to/skill/directory

Alternatively, create a .env file in the project root instead of exporting variables:

cp .env.example .env
# Edit .env with your keys

skill-sentinel scan [provider] [OPTIONS]

Positional:
  provider              cursor / claude / codex / openclaw to auto-discover that
                        provider's skills, or omit to discover all.
                        Can also be a direct path to a skill directory.

Path flags (mutually exclusive):
  --skill PATH          Scan a single skill directory.
  --dir PATH            Scan all skill subdirectories inside a parent directory.

Options:
  -o, --output PATH     Single scan: output file (default: report.json).
                        Multi-scan: output directory (default: ./skill_sentinel_reports).
  --parallel            Scan multiple skills in parallel (5 concurrent).
  -m, --model MODEL     OpenAI model to use (default: gpt-5.4-mini).
  --api-key KEY         OpenAI API key (prefer OPENAI_API_KEY env var).
  -V, --version         Show version and exit.

# Scan a single skill directory
skill-sentinel scan --skill ./my-skill
skill-sentinel scan --skill ./my-skill -o report.json

# Scan all skills inside a parent directory
skill-sentinel scan --dir ./all-my-skills/
skill-sentinel scan --dir ./all-my-skills/ -o ./reports/

# Scan in parallel (5 concurrent)
skill-sentinel scan --dir ./all-my-skills/ --parallel

# Auto-discover and scan ALL skills from cursor, claude, codex, and openclaw paths
skill-sentinel scan

# Auto-discover only Cursor skills, in parallel
skill-sentinel scan cursor --parallel

# Scan only Claude skills
skill-sentinel scan claude

# Custom output directory for auto-discovery
skill-sentinel scan codex -o ./my-reports/

# Use a different model
skill-sentinel scan --skill ./my-skill -m gpt-4o

When no path is given (or a provider keyword is used), the scanner searches these well-known locations for skill directories containing a SKILL.md:

Reports are saved as <provider>__<skill_name>.json in ./skill_sentinel_reports/ (or the directory specified with -o).

from skill_sentinel.main import scan

report = scan("/path/to/skill", output_path="report.json", model="gpt-5.4-mini")
print(report["overall_risk_assessment"]["skill_verdict"])

The scanner performs a multi-step security analysis:

1. File Discovery — lists all files in the skill directory (static, no LLM).
2. VirusTotal Binary Scan (optional) — if binary files (executables, archives, images, PDFs, etc.) are found and a VIRUSTOTAL_API_KEY is set, each binary is checked against VirusTotal's malware database via SHA-256 hash lookup. Results are passed to the report synthesizer.
3. SKILL.md Analysis — an agent reads the SKILL.md manifest and instructions, looking for prompt injection, trust abuse, discovery abuse, and other threats.
4. File Verification (conditional) — if the skill contains scripts or referenced files beyond SKILL.md, a second agent reads each file and checks alignment with SKILL.md claims, searching for command injection, data exfiltration, hardcoded secrets, obfuscation, etc.
5. Report Synthesis — a final agent combines all findings (including VirusTotal results), filters false positives, prioritizes findings, and produces a structured JSON report.

If a VIRUSTOTAL_API_KEY environment variable is set, Skill Sentinel automatically scans binary files found in skill packages against VirusTotal's malware database. This runs before the agent pipeline — no LLM calls are needed.

Supported binary types: executables (.exe, .dll, .so, .dylib, .bin), archives (.zip, .tar, .gz, .7z, .rar), documents (.pdf, .doc, .xls), images (.png, .jpg, .gif), JVM/WASM (.jar, .war, .wasm, .class), and more.

Getting a free API key: Sign up at virustotal.com — the free tier allows 500 lookups/day, which is more than enough for skill scanning.

The scanner writes a JSON report containing:

• skill_path — absolute path to the scanned skill directory
• validated_findings — confirmed threats with severity, evidence, remediation
• false_positives — dismissed findings with reasoning
• priority_order — ranked list of finding IDs
• correlations — related findings grouped together
• recommendations — actionable next steps
• references — VirusTotal scan links and other reference URLs
• overall_risk_assessment — risk level, verdict (SAFE / SUSPICIOUS / MALICIOUS), reasoning
• token_usage — LLM token usage metrics for the scan
• skill_name — skill name from the SKILL.md frontmatter (falls back to the folder name)
• content_hash — sha256 over all files in the skill directory (a change/dedup key)
• scan_duration — wall-clock scan time ({seconds, display})

skill_scanner_package/
├── pyproject.toml              # Package build config
├── README.md
└── src/skill_sentinel/
    ├── __init__.py             # Package version
    ├── cli.py                  # CLI entry point
    ├── main.py                 # Programmatic API
    ├── crew.py                 # Multi-agent crew definition
    ├── config/
    │   ├── agents.yaml         # Agent definitions
    │   └── tasks.yaml          # Task definitions
    ├── data/
    │   ├── threat_categories.md    # Threat taxonomy
    │   └── report_schema.json      # Output JSON schema
    └── tools/
        ├── custom_tool.py      # ReadFile & Grep tools
        ├── file_discovery.py   # Static file listing
        └── virustotal_tool.py  # VirusTotal binary malware scanning

By default the scanner uses a single primary model. Set FALLBACK_MODELS to a comma-separated list of provider/model strings to make each agent try the primary first and fall back to the next model when a call fails with a transient or provider-level error (rate limit, quota exhausted, 5xx, connection, or auth). Non-retryable errors (e.g. a malformed request) are not retried. Fallbacks may be a different provider than the primary:

export OPENAI_API_KEY="sk-..."          # primary (OpenAI, native)
export ANTHROPIC_API_KEY="sk-ant-..."   # first fallback
export GROQ_API_KEY="gsk_..."           # second fallback (via LiteLLM)
export OPENAI_MODEL_NAME="gpt-5.4-mini"
export FALLBACK_MODELS="anthropic/claude-<model-id>,groq/llama-3.3-70b-versatile"

Each model authenticates with its provider's standard key env var. OpenAI, Anthropic, and Gemini ship as native providers with this package. Most other providers work with no extra setup — either as native OpenAI-compatible providers (DeepSeek, OpenRouter, Bedrock, …) or through the bundled LiteLLM backend using their usual provider/model id (Groq, Together, Mistral, Cohere, xAI, …). A native-only provider not bundled here (e.g. Azure) additionally needs its CrewAI extra installed (e.g. pip install "crewai[...]"); a fallback whose provider isn't installed is skipped with a warning and never breaks the primary.

Skill Sentinel detects the following threat categories, mapped to OWASP Top 10 for LLM Applications 2025 and OWASP Top 10 for Agentic Applications:

Contributions are welcome! By submitting a pull request or other contribution, you agree to the terms of our Contributor License Agreement (CLA). See CONTRIBUTING.md for setup, project structure, and how to submit a PR.

This project is licensed under the Apache License 2.0.

Copyright 2025 Enkrypt AI, Inc.