What SkillScan looks for
Shell command execution
eval, exec, child_process, curl | bash and remote execution patterns.
Network calls
fetch, requests, raw sockets — potential exfiltration channels.
Credential access
SSH keys, AWS, .env files and sensitive variables.
Persistence
Changes to .bashrc, crontab, systemctl and startup files.
Code obfuscation
base64+eval, long encoded strings, hex payloads.
Dynamic install
pip/npm install at runtime pulling unaudited code.
How it works
1
ZIP / Link
Submit your skill for analysis
2
Static analysis + AI
What SkillScan looks for
3
Verdict
No suspicious patterns detected by static rules.
Submit your skill for analysis
Static analysis + AI · No signup
Frequently asked questions
What is SkillScan?
Is my code stored on the server?
Does SkillScan execute the code?
What file types are accepted?
How does payment work?
Do false positives exist?