Built an offline static scanner for AI agent skills (SKILL.md) to detect prompt injections and secret stealers before install

Hey everyone, lately I’ve been looking into how engineering teams interact with agentic frameworks like CrewAI, AutoGen, and custom internal platforms. As teams scale, they rely heavily on "Skill Bundles"-packages containing a SKILL.md instruction file along with supporting Python, Shell, or JavaScript scripts.

While talking to platform leads and security engineers, a common problem kept coming up: teams are installing third-party AI skills with full execution trust, but zero automated security checks before install. Traditional SAST tools scan code syntax, but they are completely blind to instruction manipulation, memory poisoning, and prompt injection inside markdown files. To fix this gap, I built an open-source static scanner called nyuwayskillscanner.

Key Features & Approach

• Dual Scanning: scans natural language instructions in SKILL.md alongside Python, JS, Shell, and PowerShell scripts.
• Threat Coverage: catches instruction overrides, memory poisoning, exfiltration endpoints, obfuscation (Base64, homoglyphs, zero-width spaces), hardcoded secrets, and destructive actions.
• Deterministic & 100% Offline: runs locally with --static-only --offline so your code and prompts are never sent to external APIs during inspection.
• Policy Packs & CI Gating: built-in profiles for default, enterprise, marketplace, audit, or strict contexts that output clear verdicts (ALLOW, REVIEW, or BLOCK) for CI pipelines.

Availability

It’s available on PyPI (pip install nyuwayskillscanner) and open-sourced on GitHub: https://github.com/Nyuway-Cybersecurity/nyuwayskillscanner.

I’d love to get feedback on how your teams are handling AI skill security and threat modeling in production!