superagent_

// security workers

Extensions and packages

[ view markdown ]

Check agent skills, MCP repositories, and registry packages before installation.

Agent skills

Score a GitHub hosted agent skill before an agent installs it or follows its instructions. Superagent treats every skill file as untrusted data and never executes fetched code.

How scoring works

A skill scan accepts a skills.sh URL, a GitHub URL pointing to a skill directory, or an owner/repository/skill identifier. The scan runs in three tiers:

  1. Identity — GitHub owner and repository age, stars, contributors, license, and archive or fork status.
  2. Static analysis — bounded retrieval of SKILL.md, scripts, rules, and references followed by checks for secret access, remote execution, install hooks, shadow chaining, and excessive scope.
  3. Content review — deterministic instruction manipulation and exfiltration checks followed by semantic review of each bounded text chunk.

The identifier is the lowercase SHA-256 digest of the canonical skill identity. The scanner resolves the current Git commit and never executes fetched code.

Limits

Your organization must install the Superagent Security GitHub App before scanning skills. Superagent uses short lived installation credentials and does not require a personal access token. Private skill repositories are not supported.

A scan reads at most 200 files, 512 KB per file, and 2 MB in total.

Threats

When details=true or the verdict is suspicious / dangerous, skill scans may emit skill_description_injection, skill_credential_parameter_extraction, skill_output_poisoning, skill_shadow_chaining_external_installation, skill_scope_violation, skill_hidden_encoded_instructions, skill_remote_execution, skill_secrets, skill_install_hooks, and skill_unscannable.

Use it

  • Dashboard: open Agents → Context, paste a skill target, and open the result for identity, behavior, and content scores.
  • REST API: POST /api/v1/context/skill to score a skill and GET /api/v1/context/skill/{identifier} to look up a previous result by SHA-256. See the Context Guardrails API.
  • MCP: scan_skill.

The target may be a skills.sh URL, owner/repository/skill, or a GitHub tree URL pointing to the skill directory.

curl "https://superagent.sh/api/v1/context/skill?mode=full&details=true" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  --data '{"target":"https://skills.sh/vercel-labs/skills/find-skills"}'

GET never starts a new scan.

MCP repositories

Score a public GitHub repository that contains an MCP server before an agent installs or connects to it. Superagent inspects repository contents only. It does not connect to a live MCP endpoint or execute the server.

How scoring works

An MCP scan accepts owner/repository or a repository URL in the form https://github.com/owner/repository with an optional .git suffix. The scan runs in three tiers:

  1. Identity — GitHub owner and repository age, stars, contributors, license, and archive or fork status.
  2. Static analysis — bounded retrieval of manifests, MCP configuration, tool definitions, schemas, source, scripts, and install hooks. The scanner checks for tool shadowing, credential harvesting, exfiltration, excessive scope, secrets, remote execution, and hidden instructions.
  3. Semantic analysis — reviews tool names, descriptions, schemas, instructions, and relevant source for description injection, instruction injection, output poisoning, schema abuse, and silent capability escalation.

The identifier is the lowercase SHA-256 digest of the canonical owner/repository identity. Superagent resolves the current Git commit and treats every fetched file as untrusted data.

Limits

MCP scans are GitHub only and require the Superagent Security GitHub App. Only public repositories are supported.

A scan reads at most 200 files, 512 KB per file, and 2 MB in total. Materialization and scan failures fail closed, producing mcp_unscannable rather than a safe result.

Threats

When details=true or the verdict is suspicious / dangerous, MCP scans may emit mcp_tool_shadowing, mcp_description_injection, mcp_instruction_injection, mcp_schema_abuse, mcp_output_poisoning, mcp_silent_capability_escalation, mcp_credential_harvesting, mcp_exfiltration, mcp_excessive_scope, mcp_hidden_encoded_instructions, mcp_remote_execution, mcp_secrets, mcp_install_hooks, and mcp_unscannable.

Use it

  • Dashboard: open Agents → Context, paste a public GitHub MCP repository, and open the result for identity, behavior, and content scores.
  • REST API: POST /api/v1/context/mcp to score a repository and GET /api/v1/context/mcp/{identifier} to look up a previous result by SHA-256. See the Context Guardrails API.
  • MCP: scan_mcp.
curl "https://superagent.sh/api/v1/context/mcp?mode=full&details=true" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  --data '{"target":"modelcontextprotocol/servers"}'
curl "https://superagent.sh/api/v1/context/mcp/<sha256>?details=true" \
  -H "Authorization: Bearer sk_live_..."

GET never starts a new scan.

Registry packages

Score a registry package before an agent installs it. Superagent uses the same supply chain pipeline as pull request supply chain scanning and maps that intelligence into identity, behavior, and content scores.

How scoring works

A package scan accepts ecosystem:name@version, for example npm:lodash@4.17.21 or pypi:requests@2.32.3. The scan runs in three tiers:

  1. Identity — package age, weekly downloads, maintainers, quality, and maintenance signals from package intelligence.
  2. Behavior — install hooks, network access, and other package-scoped alerts.
  3. Content — the same LLM risk assessment used by supply chain scanning on pull requests, inverted into a 0–100 safety score.

The identifier is the lowercase SHA-256 digest of the canonical coordinate. Aliases pip (PyPI), gem (RubyGems), and actions (GitHub Actions) are accepted.

Supported ecosystems

Supported ecosystems are npm, PyPI, Go, RubyGems, and GitHub Actions. Scan failures fail closed, producing package_unscannable rather than a safe result.

Pull request dependency checks continue to use this pipeline automatically when a supported lockfile changes.

Threats

When details=true or the verdict is suspicious / dangerous, package scans may emit package_network_access, package_install_hooks, package_credential_access, and package_unscannable when package intelligence or the risk assessment reports those behaviors.

Use it

  • Dashboard: open Agents → Context, paste a package coordinate, and open the result for identity, behavior, and content scores.
  • REST API: POST /api/v1/context/package to score a coordinate and GET /api/v1/context/package/{identifier} to look up a previous result by SHA-256. See the Context Guardrails API.
  • MCP: scan_package.
curl "https://superagent.sh/api/v1/context/package?mode=full&details=true" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  --data '{"target":"npm:lodash@4.17.21"}'
curl "https://superagent.sh/api/v1/context/package/<sha256>?details=true" \
  -H "Authorization: Bearer sk_live_..."

GET never starts a new scan.

Next steps