> For clean Markdown of this page, append .md to its URL. For the complete documentation index, see https://www.superagent.sh/llms.txt.


Check agent skills, MCP repositories, and registry packages before installation.

# Extensions and packages

## Agent skills

Score a GitHub hosted agent skill before an agent installs it or follows its instructions. Superagent treats every skill file as untrusted data and never executes fetched code.

### How scoring works

A skill scan accepts a skills.sh URL, a GitHub URL pointing to a skill directory, or an `owner/repository/skill` identifier. The scan runs in three tiers:

1. **Identity** — GitHub owner and repository age, stars, contributors, license, and archive or fork status.
2. **Static analysis** — bounded retrieval of `SKILL.md`, scripts, rules, and references followed by checks for secret access, remote execution, install hooks, shadow chaining, and excessive scope.
3. **Content review** — deterministic instruction manipulation and exfiltration checks followed by semantic review of each bounded text chunk.

The identifier is the lowercase SHA-256 digest of the canonical skill identity. The scanner resolves the current Git commit and never executes fetched code.

### Limits

Your organization must install the Superagent Security GitHub App before scanning skills. Superagent uses short lived installation credentials and does not require a personal access token. Private skill repositories are not supported.

A scan reads at most 200 files, 512 KB per file, and 2 MB in total.

### Threats

When `details=true` or the verdict is `suspicious` / `dangerous`, skill scans may emit `skill_description_injection`, `skill_credential_parameter_extraction`, `skill_output_poisoning`, `skill_shadow_chaining_external_installation`, `skill_scope_violation`, `skill_hidden_encoded_instructions`, `skill_remote_execution`, `skill_secrets`, `skill_install_hooks`, and `skill_unscannable`.

### Use it

- **Dashboard**: open **Agents → Context**, paste a skill target, and open the result for identity, behavior, and content scores.
- **REST API**: `POST /api/v1/context/skill` to score a skill and `GET /api/v1/context/skill/{identifier}` to look up a previous result by SHA-256. See the [Context Guardrails API](https://www.superagent.sh/docs/api/context-guardrails).
- **MCP**: `scan_skill`.

The `target` may be a skills.sh URL, `owner/repository/skill`, or a GitHub tree URL pointing to the skill directory.

```bash
curl "https://superagent.sh/api/v1/context/skill?mode=full&details=true" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  --data '{"target":"https://skills.sh/vercel-labs/skills/find-skills"}'
```

`GET` never starts a new scan.

## MCP repositories

Score a public GitHub repository that contains an MCP server before an agent installs or connects to it. Superagent inspects repository contents only. It does not connect to a live MCP endpoint or execute the server.

### How scoring works

An MCP scan accepts `owner/repository` or a repository URL in the form `https://github.com/owner/repository` with an optional `.git` suffix. The scan runs in three tiers:

1. **Identity** — GitHub owner and repository age, stars, contributors, license, and archive or fork status.
2. **Static analysis** — bounded retrieval of manifests, MCP configuration, tool definitions, schemas, source, scripts, and install hooks. The scanner checks for tool shadowing, credential harvesting, exfiltration, excessive scope, secrets, remote execution, and hidden instructions.
3. **Semantic analysis** — reviews tool names, descriptions, schemas, instructions, and relevant source for description injection, instruction injection, output poisoning, schema abuse, and silent capability escalation.

The identifier is the lowercase SHA-256 digest of the canonical `owner/repository` identity. Superagent resolves the current Git commit and treats every fetched file as untrusted data.

### Limits

MCP scans are GitHub only and require the Superagent Security GitHub App. Only public repositories are supported.

A scan reads at most 200 files, 512 KB per file, and 2 MB in total. Materialization and scan failures fail closed, producing `mcp_unscannable` rather than a safe result.

### Threats

When `details=true` or the verdict is `suspicious` / `dangerous`, MCP scans may emit `mcp_tool_shadowing`, `mcp_description_injection`, `mcp_instruction_injection`, `mcp_schema_abuse`, `mcp_output_poisoning`, `mcp_silent_capability_escalation`, `mcp_credential_harvesting`, `mcp_exfiltration`, `mcp_excessive_scope`, `mcp_hidden_encoded_instructions`, `mcp_remote_execution`, `mcp_secrets`, `mcp_install_hooks`, and `mcp_unscannable`.

### Use it

- **Dashboard**: open **Agents → Context**, paste a public GitHub MCP repository, and open the result for identity, behavior, and content scores.
- **REST API**: `POST /api/v1/context/mcp` to score a repository and `GET /api/v1/context/mcp/{identifier}` to look up a previous result by SHA-256. See the [Context Guardrails API](https://www.superagent.sh/docs/api/context-guardrails).
- **MCP**: `scan_mcp`.

```bash
curl "https://superagent.sh/api/v1/context/mcp?mode=full&details=true" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  --data '{"target":"modelcontextprotocol/servers"}'
```

```bash
curl "https://superagent.sh/api/v1/context/mcp/<sha256>?details=true" \
  -H "Authorization: Bearer sk_live_..."
```

`GET` never starts a new scan.

## Registry packages

Score a registry package before an agent installs it. Superagent uses the same supply chain pipeline as [pull request supply chain scanning](https://www.superagent.sh/docs/security-workers/pr-security) and maps that intelligence into identity, behavior, and content scores.

### How scoring works

A package scan accepts `ecosystem:name@version`, for example `npm:lodash@4.17.21` or `pypi:requests@2.32.3`. The scan runs in three tiers:

1. **Identity** — package age, weekly downloads, maintainers, quality, and maintenance signals from package intelligence.
2. **Behavior** — install hooks, network access, and other package-scoped alerts.
3. **Content** — the same LLM risk assessment used by supply chain scanning on pull requests, inverted into a 0–100 safety score.

The identifier is the lowercase SHA-256 digest of the canonical coordinate. Aliases `pip` (PyPI), `gem` (RubyGems), and `actions` (GitHub Actions) are accepted.

### Supported ecosystems

Supported ecosystems are npm, PyPI, Go, RubyGems, and GitHub Actions. Scan failures fail closed, producing `package_unscannable` rather than a safe result.

Pull request dependency checks continue to use this pipeline automatically when a supported lockfile changes.

### Threats

When `details=true` or the verdict is `suspicious` / `dangerous`, package scans may emit `package_network_access`, `package_install_hooks`, `package_credential_access`, and `package_unscannable` when package intelligence or the risk assessment reports those behaviors.

### Use it

- **Dashboard**: open **Agents → Context**, paste a package coordinate, and open the result for identity, behavior, and content scores.
- **REST API**: `POST /api/v1/context/package` to score a coordinate and `GET /api/v1/context/package/{identifier}` to look up a previous result by SHA-256. See the [Context Guardrails API](https://www.superagent.sh/docs/api/context-guardrails).
- **MCP**: `scan_package`.

```bash
curl "https://superagent.sh/api/v1/context/package?mode=full&details=true" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  --data '{"target":"npm:lodash@4.17.21"}'
```

```bash
curl "https://superagent.sh/api/v1/context/package/<sha256>?details=true" \
  -H "Authorization: Bearer sk_live_..."
```

`GET` never starts a new scan.

## Next steps

- [Understand supply chain scanning](https://www.superagent.sh/docs/security-workers/pr-security/supply-chain-scanning)
- [Red-team a package](https://www.superagent.sh/docs/security-workers/red-team/packages)
- [Return to Context Guardrails](https://www.superagent.sh/docs/security-workers/agent-guardrails/context)

---
Source: https://www.superagent.sh/docs/security-workers/agent-guardrails/extensions-and-packages
Index: https://www.superagent.sh/llms.txt