bastionskill
scanPre-flight skill-poisoning scanner
Detect malicious bundled code — hook-install persistence, network egress, secret theft, opaque binaries — in agent skills before you install them.
pip install bastionskill Code-layer complement to bastionsupply; prompt-layer scanning via the optional [prompt] extra.
What it does
- Static code-layer scan of a skill’s bundled scripts — regex + a Python AST tier, no LLM, no execution
- Catches hook-install/persistence, lateral tampering, egress, secret reads, obfuscation, and opaque/renamed binaries
- Shadow detection: flags capabilities the code exercises that SKILL.md never declared
- Scan a local dir, a whole skills folder, or a remote repo pre-flight; CI gate (--fail-on) + harden emits an agentbastion/bastiongate policy
Quickstart
bastionskill scan Rinkia/poisoned-skill-demo
bastionskill scan ~/.claude/skills --fail-on review
Version 0.3.0 · MIT