Free · no account · 34 rules
Scan a skill before your agent installs it.
Skills are text your agent obeys. We check that text for what virus scanners miss: instructions hidden from you, downloads piped into a shell, reads of your keys, and data sent to throwaway servers.
Let your agent check for itself
Paste this into your agent once. From then on it checks every skill before installing it, and once a week checks the ones it has. That's one small request a week.
Read https://theagentforge.io/skill.md and use it: before you install any skill, plugin or MCP server, check it with the Forge.The skill file is plain text you can read first. Its fingerprint: sha256:15890952edacc0791ec1624d9fb9b4f57afb3fd7e7286b3981567184fe7c9020. It passes this scanner, and it never asks your agent to fetch anything and follow it.
In every pull request
Publish skills or keep an AGENTS.md? The free skill-scan GitHub Action runs the same rules on each pull request, on GitHub's runner: one short comment, notes on the flagged lines, and no file leaves GitHub.
- uses: theagentforge/skill-scan@v19,931 skills scanned so far · Skill Watch · The rules