Sentry / skills/skill-scanner/SKILL.md
Skill Scanner
Reviews an agent skill before you install it, with a static scan script plus checks for injection, risky scripts, permissions and supply-chain links.
Source reviewed · reviewed · Named sources were inspected. No runtime results are established by this label.
01 / Task fit
Where it may help.
These are intended uses indicated by the upstream material. They are not measured outcomes.
- Pre-install review of third-party skills
- Spotting skills that change agent configuration
What it is
Skill Scanner runs a bundled Python scanner on a skill folder, then has the agent review the results: frontmatter, prompt-injection patterns, whether instructions match the description, scripts, external URLs and requested tools. It ends with a rating and an install recommendation. It warns that security-related skills often mention attack patterns legitimately.
Why you might use it
Use it as a first pass before adding a third-party skill to an agent that can read files or run commands. It complements reading the skill yourself; it does not replace it.
Put it in context.
Illustrative requests and outputs to review. These examples are separate from the recorded evaluation below.
Scan a downloaded skill
Example request
Scan the skill in ./downloads/report-builder before I install it. Explain each finding in plain language.
What to look for. A findings list with severity and confidence, and an install recommendation.
Before you rely on it. A clean scan doesn't prove a skill is safe. Read any scripts yourself before granting shell access.
Check a skill for config changes
Example request
Check whether this skill tries to modify agent settings, memory files or hooks.
What to look for. A short answer pointing to any lines that write to agent configuration.
Before you rely on it. Pattern checks can miss obfuscated behavior. Treat no findings as unknown, not safe.
02 / Setup & access
What it asks of your environment.
Requirements
- uv for the bundled scanner script, and an agent with Read, Grep, Glob and Bash.
- A local copy of the skill to scan.
Permissions & data access
- Reads the target skill folder and runs the bundled scanner script.
- The skill itself requests Bash. Run it on untrusted skills in a disposable environment.
Instructions alone do not enforce a sandbox. The agent host, connected tools and approvals determine what the skill can actually read, change or send.
03 / Things to check
Security concerns & practical limits.
These concerns follow from the reviewed sources. They describe possible exposure or required review; they are not confirmed vulnerabilities.
Review before use
The scanner runs code on your machine
Scanning uses a bundled script and requests Bash. Review the script or run it in a sandbox before scanning untrusted material.
Review before use
No findings is not proof of safety
Static patterns and model review can both miss malicious behavior. Keep reading scripts and limiting tool access.
Limits and nuances
- Source review of SKILL.md and the repository license only. The scanner script and its reference pattern files were not reviewed or run.
- No skill was scanned. No detection-rate result is claimed.
04 / Review record
What we checked. What’s still open.
Recorded review scope
- skills/skill-scanner/SKILL.md
- LICENSE
Not tested or established
- Source review of SKILL.md and the repository license only. The scanner script and its reference pattern files were not reviewed or run.
- No skill was scanned. No detection-rate result is claimed.
- Review date
- Source revision
f57ada2d0b640406ea7e25b11d636c530e77c58b- Our relationship
- Explored. Investigated through the recorded review. No use or replication is claimed.
Upstream content can change after review. A repository revision identifies source scope; it does not prove that every script, dependency or runtime behavior was tested. How freshness is handled.
Recorded evaluation / Source review
Results with their limits attached.
Completed 4 bounded source checks on the pinned entrypoint and license. No skill workflow was executed.
- Passed
- 4
- Failed
- 0
- Total recorded
- 4
These counts refer to the cases in this report. They are not a benchmark against other skills. A source review does not establish runtime behavior.
Read the evidence reportThe report provides the case definitions, observations and baseline scope. Missing baselines or untested behaviors remain limitations.
Recorded environment
- Pinned public UTF-8 sources fetched from raw.githubusercontent.com at the recorded commit and hashed with SHA-256.
- Linux; Python 3.13.5 source-condition check. No account, credentials, private documents or live business data.
Recorded commands (2)
Commands document this evaluation. They are not setup instructions for your environment.
Read each pinned file listed in sourceManifest.python3 r6_skills.py: check each recorded source condition and reconcile report counts.Findings from this evaluation
Needs attention
The scanner runs code on your machine
Scanning uses a bundled script and requests Bash. Review the script or run it in a sandbox before scanning untrusted material.
Needs attention
No findings is not proof of safety
Static patterns and model review can both miss malicious behavior. Keep reading scripts and limiting tool access.
Observation
False positives addressed
The skill tells the agent to judge intent, since security skills may document attack patterns.
Evaluation limitations
- Source review of SKILL.md and the repository license only. The scanner script and its reference pattern files were not reviewed or run.
- No skill was scanned. No detection-rate result is claimed.
05 / Reuse & discovery
License, attribution & popularity.
Apache-2.0
Apache-2.0 license text inspected at this revision. Keep the license and any NOTICE when redistributing covered files. The services and accounts the skill uses have their own terms.
Why it is in this collection
GitHub displayed 1,066 stars for the getsentry/skills repository on the observation date. Repository-wide; not individual skill usage, quality or safety.
1,066 repository stars
- Scope
- Entire getsentry/skills repository, not this individual skill
- Observed
- Time window
- Snapshot observed 2026-10-19
Popularity and inclusion do not establish quality, compatibility or security. Counts belong to their named metric and date; they are not a current ranking.
06 / Follow the evidence
Go to the original.
- Pinned skill instructions github.com
- Pinned license github.com
- Repository (dated star count) github.com
IonBin’s source notes are independent assessments. Upstream authors retain their work and attribution. This page does not install or execute the skill.