skill-sentry
Static, local, explainable pre-install security audit for Agent Skills. Scans SKILL.md/scripts/config for destructive commands, hidden network calls, secret reads, obfuscation, prompt injection, persistence. CLI + 36 fixtures + GitHub Actions.
What it does
Static, local, explainable pre-install security audit for Agent Skills. Scans SKILL.md/scripts/config for destructive commands, hidden network calls, secret reads, obfuscation, prompt injection, persistence. CLI + 36 fixtures + GitHub Actions.
Installation
dsh plugin --profile web add github:whaojie797-design/skill-sentryInstall method: GitHub · not yet tested in container (L3+)
Compatibility
| DSH Version | Status |
|---|---|
| not stated | Declared — not tested |
Requirements
- • Node.js: not stated
- • DSH: declared "not stated"
- • External credentials: none detected
Security Report
Automated static scan, not manual review.
No security scan record for this plugin yet. Newly indexed plugins are scanned by the daily pipeline.
——d367dfd070ffThe scan result is only valid for the scanned commit. If the latest commit differs, the badge shows outdated until the daily pipeline rescans.
Disclaimer: automated static analysis, not a security guarantee. Always review what you install.
• Static heuristic scan: pending
• Dependency vulnerabilities: —
• Hardcoded secrets: —
• Supply chain risks: —
Activity
Last commit 2026-07-30 · activity: Active
• Repo created: 2026-08-19
• Stars: ★ 0 · Forks: 0
• Health: Active — committed within last 30 days