superagent_

// context guardrails

Agent skills

Statically score a skills.sh or GitHub hosted agent skill before an agent installs or follows it.

Score a GitHub hosted agent skill before an agent installs it or follows its instructions. Superagent treats every skill file as untrusted data and never executes fetched code.

How scoring works

A skill scan accepts a skills.sh URL, a GitHub URL pointing to a skill directory, or an owner/repository/skill identifier. The scan runs in three tiers:

  1. Identity — GitHub owner and repository age, stars, contributors, license, and archive or fork status.
  2. Static analysis — bounded retrieval of SKILL.md, scripts, rules, and references followed by checks for secret access, remote execution, install hooks, shadow chaining, and excessive scope.
  3. Content review — deterministic instruction manipulation and exfiltration checks followed by semantic review of each bounded text chunk.

The identifier is the lowercase SHA-256 digest of the canonical skill identity. The scanner resolves the current Git commit and never executes fetched code.

Limits

Your organization must install the Superagent Security GitHub App before scanning skills. Superagent uses short lived installation credentials and does not require a personal access token. Private skill repositories are not supported.

A scan reads at most 200 files, 512 KB per file, and 2 MB in total.

Threats

When details=true or the verdict is suspicious / dangerous, skill scans may emit skill_description_injection, skill_credential_parameter_extraction, skill_output_poisoning, skill_shadow_chaining_external_installation, skill_scope_violation, skill_hidden_encoded_instructions, skill_remote_execution, skill_secrets, skill_install_hooks, and skill_unscannable.

Use it

  • Dashboard: open Agents → Context, paste a skill target, and open the result for identity, behavior, and content scores.
  • REST API: POST /api/v1/context/skill to score a skill and GET /api/v1/context/skill/{identifier} to look up a previous result by SHA-256. See the Context Guardrails API.
  • MCP: scan_skill.

The target may be a skills.sh URL, owner/repository/skill, or a GitHub tree URL pointing to the skill directory.

curl "https://superagent.sh/api/v1/context/skill?mode=full&details=true" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  --data '{"target":"https://skills.sh/vercel-labs/skills/find-skills"}'

GET never starts a new scan.

Next steps