@mondoohq/skillcheck 0.2.0 → 0.3.3

package/LICENSE

@@ -0,0 +1,190 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to the Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by the Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding any notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 Mondoo, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,109 @@
+# skillcheck
+
+Know whether the AI agent skills on your machine are safe — in seconds, with no install.
+
+```bash
+npx @mondoohq/skillcheck
+```
+
+![skillcheck demo](demo.gif)
+
+AI coding agents load skills, plugins, and MCP servers that run with your permissions. A
+malicious one can inject prompts, steal credentials, or exfiltrate code. skillcheck finds
+everything installed across 25 agents — Claude Code, Cursor, Codex, Gemini CLI, Copilot,
+Windsurf, and [more](https://github.com/mondoohq/skillcheck/blob/main/docs/supported-agents.md) —
+and checks it against the [Mondoo AI Agent Security](https://mondoo.com/ai-agent-security)
+database of 1,200+ analyzed skills and 25+ threat categories.
+
+## What you can do with it
+
+### Find out if your machine is exposed
+
+Run it once and get a verdict for every skill, plugin, and MCP server your agents can load:
+severity, a one-line summary of the threat, and a link to the full security report.
+
+```bash
+npx @mondoohq/skillcheck            # scan every detected agent
+npx @mondoohq/skillcheck --verbose  # include content hashes and report URLs
+```
+
+### Stop risky skills from reaching your builds
+
+skillcheck exits **1** when it finds a critical or high-risk skill, so it works as a gate in
+any pipeline, dev container, or onboarding script:
+
+```yaml
+# GitHub Actions
+- run: npx @mondoohq/skillcheck
+```
+
+```bash
+# Any CI system: machine-readable output, no color codes
+npx @mondoohq/skillcheck --json --no-color
+```
+
+It fails open: a skill the database hasn't analyzed yet shows as clean and never blocks you.
+
+### Ship a skills repository that agents can actually load
+
+If you publish skills, `validate` checks your repository against the
+[Agent Skills](https://agentskills.io/specification) and [AGENTS.md](https://agents.md/)
+specifications — catching bad skill names, oversized descriptions, and a missing
+`AGENTS.md` or marketplace manifest before your users do.
+
+```bash
+npx @mondoohq/skillcheck validate .                    # current directory
+npx @mondoohq/skillcheck validate ./my-skills --json   # any path, JSON output
+```
+
+```text
+Validating /path/to/repo
+
+Agent Skills spec (SKILL.md)
+  ✓ Every skill name is a lowercase slug (a-z0-9, single hyphens)
+  ✓ Every skill name is 1-64 characters
+  ✓ Every skill name equals its directory name
+  ✓ Every skill description is 1-1024 characters
+Repository contract (agents.md + marketplace)
+  ✓ A root AGENTS.md exists (agents.md convention)
+  ✓ .claude-plugin/marketplace.json exists and lists plugins
+
+PASS 6 passed, 0 failed
+```
+
+It exits **1** if any check fails, so it drops straight into a skills repo's CI. The rules
+are an embedded [MQL](https://mondoo.com/docs/mql/home/) policy
+([`repo-contract.mql.yaml`](https://github.com/mondoohq/skillcheck/blob/main/internal/validate/policy/repo-contract.mql.yaml)),
+and because it is a standard cnspec bundle, `cnspec scan filesystem <repo> -f
+repo-contract.mql.yaml` runs the identical checks.
+
+## How the scan works
+
+For each detected agent, skillcheck:
+
+1. Discovers installed skills, plugins, MCP servers, and rules
+2. Computes a SHA-256 content hash for each skill
+3. Looks the hash up in the [Mondoo skill database](https://mondoo.com/ai-agent-security/skills)
+4. Reports findings with severity, summary, and a link to the full security report
+
+Only hashes are sent, never skill contents. See
+[supported agents](https://github.com/mondoohq/skillcheck/blob/main/docs/supported-agents.md)
+for where skillcheck looks for each agent.
+
+## Install
+
+`npx` always runs the latest release. To keep it installed:
+
+```bash
+npm i -g @mondoohq/skillcheck
+```
+
+Standalone binaries for macOS, Linux, and Windows are on
+[GitHub Releases](https://github.com/mondoohq/skillcheck/releases).
+
+## Links
+
+- [Mondoo AI Agent Security](https://mondoo.com/ai-agent-security)
+- [Skill Database](https://mondoo.com/ai-agent-security/skills) — browse 1,200+ analyzed skills
+- [Security Checks](https://mondoo.com/ai-agent-security/checks) — 25+ threat categories
+- [Supported agents](https://github.com/mondoohq/skillcheck/blob/main/docs/supported-agents.md)

package/bin/skillcheck.js

@@ -0,0 +1,160 @@
+#!/usr/bin/env node
+// Copyright Mondoo, Inc. 2026
+// SPDX-License-Identifier: Apache-2.0
+
+// Launcher for the `skillcheck` command installed from npm.
+//
+// npm cannot ship one package with six platform binaries, so
+// `@mondoohq/skillcheck` is a thin wrapper: it declares the six
+// `@mondoohq/skillcheck_<os>_<arch>` packages as optionalDependencies (npm
+// installs only the one matching `os`/`cpu`) and this script runs whichever one
+// landed.
+//
+// Its job is to be invisible, which takes two things:
+//
+//   - THE EXIT CODE. skillcheck exits 1 when a scan finds critical/high-risk
+//     skills or `skillcheck validate` fails a check, and CI gates on that. A
+//     launcher that spawns the binary without reading its status exits 0
+//     always, which silently disables every such gate for npm users.
+//   - SIGNALS. Without forwarding, Ctrl+C kills the launcher and leaves the
+//     binary running detached.
+
+'use strict';
+
+const os = require('os');
+const path = require('path');
+const { spawn } = require('child_process');
+
+// The platform packages, keyed by `${process.platform}_${process.arch}`.
+// Keep in sync with PLATFORMS in scripts/npm-package.mjs.
+const PLATFORM_PACKAGES = {
+  linux_x64: { pkg: '@mondoohq/skillcheck_linux_amd64', bin: 'skillcheck' },
+  linux_arm64: { pkg: '@mondoohq/skillcheck_linux_arm64', bin: 'skillcheck' },
+  darwin_x64: { pkg: '@mondoohq/skillcheck_darwin_amd64', bin: 'skillcheck' },
+  darwin_arm64: { pkg: '@mondoohq/skillcheck_darwin_arm64', bin: 'skillcheck' },
+  win32_x64: { pkg: '@mondoohq/skillcheck_windows_amd64', bin: 'skillcheck.exe' },
+  win32_arm64: { pkg: '@mondoohq/skillcheck_windows_arm64', bin: 'skillcheck.exe' },
+};
+
+// A launcher failure must never look like success.
+const EXIT_FAILURE = 1;
+
+function fail(message) {
+  process.stderr.write(`skillcheck: ${message}\n`);
+  process.exit(EXIT_FAILURE);
+}
+
+// candidateKeys lists the PLATFORM_PACKAGES keys to try, most preferred first.
+//
+// npm installs the optionalDependency matching the CPU of the Node that ran
+// `npm install`, not the machine's, so switching Node builds afterwards leaves
+// the "wrong" package on disk. Where the OS can run the other CPU's binary
+// anyway, that package is an acceptable fallback:
+//
+//   - win32: Windows on ARM64 runs both arm64 and x64 binaries (x64 under
+//     emulation), and an x64 Node there is common. arm64 <-> x64 both ways.
+//   - darwin: Apple Silicon runs x64 binaries under Rosetta, so an arm64 Node
+//     may use the x64 package. Not the reverse: an x64 Node may be on an Intel
+//     Mac, which cannot run arm64.
+//   - linux: strict. There is no general cross-CPU execution, and a binary
+//     that fails to exec is worse than a clear "not installed".
+function candidateKeys(platform, arch) {
+  const keys = [`${platform}_${arch}`];
+  if (platform === 'win32') {
+    if (arch === 'arm64') keys.push('win32_x64');
+    else if (arch === 'x64') keys.push('win32_arm64');
+  } else if (platform === 'darwin' && arch === 'arm64') {
+    keys.push('darwin_x64');
+  }
+  return keys;
+}
+
+// resolveBinary finds the platform binary, or explains why it cannot. Each
+// failure is something the user can act on, so each gets a sentence rather than
+// a module-resolution stack trace.
+//
+// platform, arch and resolve default to the real process and require.resolve;
+// tests inject them. Returns { path } on success or { error } with the message.
+function resolveBinary({ platform = process.platform, arch = process.arch, resolve = require.resolve } = {}) {
+  const targets = candidateKeys(platform, arch)
+    .map((key) => PLATFORM_PACKAGES[key])
+    .filter(Boolean);
+  if (targets.length === 0) {
+    const supported = Object.keys(PLATFORM_PACKAGES).sort().join(', ');
+    return {
+      error:
+        `no prebuilt binary for ${platform}/${arch}.\n` +
+        `  supported: ${supported}\n` +
+        '  other platforms: https://github.com/mondoohq/skillcheck/releases',
+    };
+  }
+  for (const target of targets) {
+    let pkgJson;
+    try {
+      pkgJson = resolve(path.posix.join(target.pkg, 'package.json'));
+    } catch {
+      continue;
+    }
+    return { path: path.join(path.dirname(pkgJson), target.bin) };
+  }
+  const preferred = targets[0].pkg;
+  const fallbacks = targets.slice(1).map((t) => t.pkg);
+  const which =
+    `the platform package ${preferred} is not installed` +
+    (fallbacks.length ? `, and neither is the fallback ${fallbacks.join(', ')}.` : '.');
+  return {
+    error:
+      `${which}\n` +
+      '  it ships as an optionalDependency, so this usually means the install ran with\n' +
+      '  --no-optional / --omit=optional, or a lockfile from a different platform was used,\n' +
+      `  or node_modules was installed by a Node build for a different CPU than this one (${arch}).\n` +
+      `  fix: npm install ${preferred}`,
+  };
+}
+
+function main() {
+  const resolved = resolveBinary();
+  if (resolved.error) fail(resolved.error);
+  const child = spawn(resolved.path, process.argv.slice(2), {
+    stdio: 'inherit',
+    env: process.env,
+  });
+
+  // Forward signals so Ctrl+C reaches the binary instead of orphaning it.
+  const forwarded = ['SIGINT', 'SIGTERM', 'SIGHUP', 'SIGQUIT', 'SIGBREAK'];
+  const handlers = [];
+  for (const signal of forwarded) {
+    // Not every platform has every signal (Windows has no SIGHUP/SIGQUIT).
+    if (!(signal in os.constants.signals)) continue;
+    const handler = () => {
+      try {
+        child.kill(signal);
+      } catch {
+        /* already exited */
+      }
+    };
+    handlers.push([signal, handler]);
+    process.on(signal, handler);
+  }
+
+  child.on('error', (err) => fail(`could not run the skillcheck binary: ${err.message}`));
+
+  child.on('close', (code, signal) => {
+    for (const [sig, handler] of handlers) process.removeListener(sig, handler);
+
+    if (signal) {
+      // Killed rather than exited: report it the way a shell does (128+signum).
+      const signum = os.constants.signals[signal];
+      process.exit(signum ? 128 + signum : EXIT_FAILURE);
+    }
+    process.exit(code === null ? EXIT_FAILURE : code);
+  });
+}
+
+// Run when executed as the `skillcheck` bin; export the resolution logic when
+// required, so scripts/npm-launcher.test.mjs can test it without spawning.
+if (require.main === module) {
+  main();
+} else {
+  module.exports = { PLATFORM_PACKAGES, candidateKeys, resolveBinary };
+}

package/package.json

@@ -1,29 +1,43 @@
 {
   "name": "@mondoohq/skillcheck",
-  "version": "0.2.0",
-  "bin": {
-    "skillcheck": "index.js"
+  "version": "0.3.3",
+  "description": "AI agent skill security scanner. Detects locally installed agent skills, computes SHA-256 checksums, and queries the Mondoo AI Agent Security database for known threats.",
+  "keywords": [
+    "ai-security",
+    "agent-skills",
+    "skillcheck",
+    "mondoo",
+    "cli",
+    "devsecops",
+    "prompt-injection",
+    "supply-chain"
+  ],
+  "homepage": "https://github.com/mondoohq/skillcheck#readme",
+  "bugs": {
+    "url": "https://github.com/mondoohq/skillcheck/issues"
   },
-  "optionalDependencies": {
-    "@mondoohq/skillcheck_linux_amd64": "0.2.0",
-    "@mondoohq/skillcheck_darwin_amd64": "0.2.0",
-    "@mondoohq/skillcheck_linux_arm64": "0.2.0",
-    "@mondoohq/skillcheck_darwin_arm64": "0.2.0",
-    "@mondoohq/skillcheck_windows_amd64": "0.2.0",
-    "@mondoohq/skillcheck_windows_arm64": "0.2.0"
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mondoohq/skillcheck.git"
   },
-  "os": [
-    "linux",
-    "darwin",
-    "win32"
-  ],
-  "cpu": [
-    "x64",
-    "arm64"
-  ],
-  "files": [],
-  "keywords": [
-    "ai-security,agent-skills,skillcheck,mondoo,cli,devsecops,prompt-injection,supply-chain"
+  "license": "Apache-2.0",
+  "bin": {
+    "skillcheck": "bin/skillcheck.js"
+  },
+  "files": [
+    "bin/",
+    "README.md",
+    "LICENSE"
   ],
-  "description": "AI agent skill security scanner. Detects locally installed agent skills, computes SHA-256 checksums, and queries the Mondoo AI Agent Security database for known threats."
-}
+  "engines": {
+    "node": ">=18"
+  },
+  "optionalDependencies": {
+    "@mondoohq/skillcheck_darwin_amd64": "0.3.3",
+    "@mondoohq/skillcheck_darwin_arm64": "0.3.3",
+    "@mondoohq/skillcheck_linux_amd64": "0.3.3",
+    "@mondoohq/skillcheck_linux_arm64": "0.3.3",
+    "@mondoohq/skillcheck_windows_amd64": "0.3.3",
+    "@mondoohq/skillcheck_windows_arm64": "0.3.3"
+  }
+}

package/index.js

@@ -1,11 +0,0 @@
-#!/usr/bin/env node
-const path = require('path');
-const child_process = require('child_process');
-const mapping = { linux_x64: { name: [ '@mondoohq', 'skillcheck_linux_amd64' ], bin: 'skillcheck' }, darwin_x64: { name: [ '@mondoohq', 'skillcheck_darwin_amd64' ], bin: 'skillcheck' }, linux_arm64: { name: [ '@mondoohq', 'skillcheck_linux_arm64' ], bin: 'skillcheck' }, darwin_arm64: { name: [ '@mondoohq', 'skillcheck_darwin_arm64' ], bin: 'skillcheck' }, win32_x64: { name: [ '@mondoohq', 'skillcheck_windows_amd64' ], bin: 'skillcheck.exe' }, win32_arm64: { name: [ '@mondoohq', 'skillcheck_windows_arm64' ], bin: 'skillcheck.exe' } };
-const definition = mapping[process.platform + '_' + process.arch];
-const packageJsonPath = require.resolve(path.join(...definition.name, 'package.json'));
-const packagePath = path.join(path.dirname(packageJsonPath), definition.bin);
-child_process.spawn(packagePath, process.argv.splice(2), {
-  stdio: 'inherit',
-  env: process.env,
-});