Read the skillbefore it readsyour machine.

Husk checks AI agent skills for credential theft, hidden installers and prompt injection before you install them. Paste one, upload it, or look it up on a marketplace.

11,224real malicious skills tested
95.4%of 4,000 real skills passed clean
0 bytesleave your machine
Check a skill
Find a skill onlineSearch a marketplace by name.

We'll fetch the published files, inspect them, and return the result.

Optional: get a second opinion from an AI model +
Model

Your key is used only for that request.

Static analysis. Nothing you submit is executed.

What people are installingright now.

SOURCE
Connecting

One scan is a snapshot.Husk covers the whole life of a skill.

Check it before publish, compare copies across registries, and keep watching after install.

1

Before publish

A pass or fail gate for your CI. Blocks a skill with dangerous code before it ever reaches a marketplace.

husk gate ./skill
2

At publish

A signed, reproducible record of the exact files scanned and the verdict. Change one byte and it no longer matches.

husk attest ./skill
3

Across registries

Fetches the same skill from every marketplace and warns when the copies differ, the sign of a swapped package.

husk crossref name
4

After install

Run it on a schedule and it tells you when an installed skill that was clean turns malicious in an update.

husk watch

Tested on real malware, not examples we wrote ourselves.

11,224 confirmed malicious skills and 4,249 legitimate skills were used to measure detection and false alarms.

HUSK BENCHMARK
95.4%
of 4,000 real skills passed clean

3,815 of 4,000 legitimate skills from an independent research set passed without a single flag.

64.8–68.3%catch rate across two datasets
11,224confirmed malicious skills
7,280 ASB-derived3,944 MalSkillBench
On a separate hand-checked set, 248 of 249 legitimate skills passed clean. On SkillTrustBench, 91.2% of 2,863 malicious skills are flagged and 59.9% blocked outright, with 1.7% of 1,643 normal skills blocked.
ScannerReal skills passedCatch rate
Husk99.6%67.3%
syedabbast/skill-scanner86.7%64.3%
SkillFortify82.3%59.7%
agent-audit92.8%53.0%
clawhub-bridge80.7%44.7%
skillfrisk91.6%42.0%
skillguard70.3%39.3%
skill-audit (npm)91.2%38.0%
agentscan-cli93.2%35.0%
agent-audit-kit93.6%27.3%
malwar92.0%24.9%
SecureAI-Scan99.6%22.3%
skill-shielder92.0%21.7%
OpenTrApp Skill Firewall96.0%21.0%
skill-security-scanner100.0%0.0%
NVIDIA SkillSpector *65.1%58.3%
Cisco AI Defense skill-scanner *88.0%51.6%

Same 699-skill sample for every tool, strict reading, current versions, no LLM. * Cisco and SkillSpector ran on a shared 200-skill subset (Husk on that subset: 60.0% caught, 98.0% passed). Full method, loose readings and raw results in BENCHMARK.md.

Benchmarked against industry security scanners

PRIVATE BY DEFAULT

Runs locally. Nothing leaves your machine.

One pip install. No account. No API key. The scanner is open source, offline, and built so you can inspect the rules behind every verdict.

Source on GitHub View on PyPI
terminalpython 3.10+
pip install husk-scanner
# check one file
husk skill path/to/SKILL.md
# gate a whole skill in CI
husk gate ./my-skill
# see why something was flagged
husk explain ./my-skill

Questions people ask first.

Short answers. The repository has the long ones.

What does Husk actually check?+
Every file in a skill: the SKILL.md instructions, bundled scripts, PDFs and archives. It looks for credential theft, curl | bash installers, reverse shells, data being sent out, and written instructions that try to hijack the agent. Its analysis engine follows data from where it came from to where it goes, through shell, Python, JavaScript and the code inside Markdown, so bash <(curl ...) and a download run three code blocks later are caught like curl | bash. Every finding names the lines that prove it.
How often does it cry wolf?+
Rarely. 248 of 249 hand-checked legitimate skills pass clean, as do 95.4% of a larger 4,000-skill research set. On the malware side, it catches 64.8 to 68.3% of confirmed malicious skills across two independent datasets. It's tuned so a flag means something, which is what lets you use it as an automatic gate.
Why not just ask an AI model to review the skill?+
You can, and Husk will do that too if you add a key. But a model's answer changes between runs. Husk gives the same verdict every time, costs nothing, runs offline, and produces a record you can verify later. It also keeps watching after install, which a one-off review can't.
Can I run it before publishing?+
That's the main use. husk gate ./my-skill returns pass or fail with an exit code, so it drops into CI or a publish step. A .huskpolicy file sets how strict it is per project.
Is anything I scan stored or run?+
No. It's static analysis, so nothing is executed. On this site the file is scanned and discarded. On your machine, nothing leaves it at all. The optional AI review only sends what you choose, with your own key.