What is skill-scanner-agent?

Skill Scanner Agent is an automated security auditing tool that scans SKILL directories for potential security risks. SKILL here refers to a specific type of directory structure containing a SKILL.md file and associated scripts. The tool uses AI language models to read through the directory, understand what the skill does, and then check the included script files for security vulnerabilities, producing written reports of its findings. The workflow runs in three steps. First it validates the SKILL directory and extracts basic information about it. Then an AI agent generates an overview report summarizing what the skill does from a security perspective. Finally, another AI agent reviews any script files found in the directory and produces a code security audit. Each of these steps can be handled by a different AI model, which you configure in a settings file. Reports are saved as markdown files and can be output in either English or Chinese. You would use this when you are responsible for reviewing skills or plugins before allowing them to run, and you want an automated first pass at identifying security concerns without reading every line of code yourself. It is particularly relevant for teams managing collections of SKILL-based tools and wanting consistent security documentation. The tech stack is Python with LangGraph for workflow orchestration, LangChain for AI model integration, and Typer for the command line interface.