skillvet: scan AI agent skills before you run them

You dropped a random SKILL.md folder into your agent and trusted it with your shell. It has the same access you do: network, ~/.ssh, every env token. Most of the time it is fine. Most of the time.

skillvet is a one-command supply-chain scanner for AI agent skills and MCP servers. It reads the tree, does not execute it, and prints a RED / YELLOW / GREEN verdict in about five seconds.

npx skillvet ./my-skill

Enter fullscreen mode