Free scan
Check a skill or agent for free
Paste a public GitHub address: a repository, a skill’s folder or an agent’s file. We read it at its latest commit and run our automated checks on it. No AI, no cost, and no account needed.
- Hidden characters. Invisible characters, or long runs of blank space that can hide text.
- Links and domains. Kinds of link we don’t list skills with: a raw IP address, a link shortener, a paste or file-sharing site, a tunnel, a link that isn’t HTTPS, a lookalike or punycode domain, an address carrying a password, or a data: or javascript: link; email addresses; or asking for something to be sent somewhere.
- Downloading or running things. Telling the agent to download, install or run software, a link beside an instruction to, or a link to a script, a program or an archive.
- Keys and private files. Telling the agent to read keys, passwords or private files, or holding a key or password itself.
- Overriding the person. Asking the agent to set aside its other instructions, or to act against or without the person using it.
- License. No license file, or one we couldn’t tell.
- Powerful tools. An agent that asks for more than reading and editing files, such as running commands, reading files and using the web together, external tools, or every tool.
- Something else. Something else a person would look at before listing it.
These are our automated checks only. A clean result isn’t Verified; listing adds a person’s review of anything flagged and a before and after. The result is yours alone: it has a link only you get, it isn’t indexed, and we delete it after 30 days. We never publish scan results.