@mondoohq/skillcheck_windows_arm64 0.3.1 → 0.3.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/README.md +48 -66
  2. package/package.json +1 -1
  3. package/skillcheck.exe +1 -1
package/README.md CHANGED
@@ -1,6 +1,6 @@
1
1
  # skillcheck
2
2
 
3
- Scan your machine for malicious AI agent skills in seconds.
3
+ Know whether the AI agent skills on your machine are safe — in seconds, with no install.
4
4
 
5
5
  ```bash
6
6
  npx @mondoohq/skillcheck
@@ -8,54 +8,29 @@ npx @mondoohq/skillcheck
8
8
 
9
9
  ![skillcheck demo](demo.gif)
10
10
 
11
- skillcheck detects locally installed AI agent skills, computes SHA-256 checksums, and checks them against the [Mondoo AI Agent Security](https://mondoo.com/ai-agent-security) database — covering prompt injection, credential theft, data exfiltration, and 25+ other threat categories across 1,200+ known skills.
12
-
13
- ## Supported Agents
14
-
15
- | Agent | Config | Skills | What's Detected |
16
- |-------|--------|--------|-----------------|
17
- | Antigravity | `~/.gemini/antigravity/` | `~/.gemini/antigravity/skills/` | skills |
18
- | Augment | `~/.augment/` | `~/.augment/skills/` | skills |
19
- | Claude Code | `~/.claude/` | `~/.claude/skills/` | skills, plugins, MCP servers |
20
- | Cline | `~/.cline/` | `~/.cline/skills/` | skills |
21
- | Continue | `~/.continue/` | `~/.continue/skills/` | skills |
22
- | Cursor | `~/.cursor/` | `~/.cursor/skills/` | skills, MCP servers, rules |
23
- | Gemini CLI | `~/.gemini/` | `~/.gemini/skills/` | skills, MCP servers |
24
- | GitHub Copilot | `~/.config/github-copilot/` | `~/.config/github-copilot/skills/` | skills, MCP servers |
25
- | Goose | `~/.config/goose/` | `~/.config/goose/skills/` | skills, extensions |
26
- | IBM Bob | `~/.bob/` | `~/.bob/skills/` | skills |
27
- | Junie | `~/.junie/` | `~/.junie/skills/` | skills |
28
- | Kilo Code | `~/.kilocode/` | `~/.kilocode/skills/` | skills |
29
- | Kiro | `~/.kiro/` | `~/.kiro/skills/` | skills |
30
- | Mistral Vibe | `~/.vibe/` | `~/.vibe/skills/` | skills |
31
- | OpenAI Codex | `~/.codex/` | `~/.codex/skills/` | skills, plugins, MCP servers |
32
- | OpenClaw | `~/.openclaw/` | `~/.openclaw/skills/` | skills |
33
- | OpenCode | `~/.config/opencode/` | `~/.config/opencode/skills/` | skills |
34
- | OpenHands | `~/.openhands/` | `~/.openhands/skills/` | skills |
35
- | Pi | `~/.pi/agent/` | `~/.pi/agent/skills/` | skills |
36
- | Qwen Code | `~/.qwen/` | `~/.qwen/skills/` | skills |
37
- | Roo | `~/.roo/` | `~/.roo/skills/` | skills |
38
- | Snowflake Cortex | `~/.snowflake/cortex/` | `~/.snowflake/cortex/skills/` | skills |
39
- | Trae | `~/.trae/` | `~/.trae/skills/` | skills |
40
- | Warp | `~/.warp/` | `~/.warp/skills/` | skills |
41
- | Windsurf | `~/.codeium/windsurf/` | `~/.codeium/windsurf/skills/` | skills, MCP servers, rules |
42
-
43
- ## Usage
11
+ AI coding agents load skills, plugins, and MCP servers that run with your permissions. A
12
+ malicious one can inject prompts, steal credentials, or exfiltrate code. skillcheck finds
13
+ everything installed across 25 agents — Claude Code, Cursor, Codex, Gemini CLI, Copilot,
14
+ Windsurf, and [more](https://github.com/mondoohq/skillcheck/blob/main/docs/supported-agents.md) —
15
+ and checks it against the [Mondoo AI Agent Security](https://mondoo.com/ai-agent-security)
16
+ database of 1,200+ analyzed skills and 25+ threat categories.
44
17
 
45
- ```bash
46
- # Scan all detected agents
47
- npx @mondoohq/skillcheck
18
+ ## What you can do with it
48
19
 
49
- # JSON output for CI/CD pipelines
50
- npx @mondoohq/skillcheck --json
20
+ ### Find out if your machine is exposed
51
21
 
52
- # Verbose output with full hashes and report URLs
53
- npx @mondoohq/skillcheck --verbose
22
+ Run it once and get a verdict for every skill, plugin, and MCP server your agents can load:
23
+ severity, a one-line summary of the threat, and a link to the full security report.
24
+
25
+ ```bash
26
+ npx @mondoohq/skillcheck # scan every detected agent
27
+ npx @mondoohq/skillcheck --verbose # include content hashes and report URLs
54
28
  ```
55
29
 
56
- ### CI/CD Integration
30
+ ### Stop risky skills from reaching your builds
57
31
 
58
- skillcheck exits with code **1** when critical or high-risk skills are found, making it easy to use as a gate:
32
+ skillcheck exits **1** when it finds a critical or high-risk skill, so it works as a gate in
33
+ any pipeline, dev container, or onboarding script:
59
34
 
60
35
  ```yaml
61
36
  # GitHub Actions
@@ -63,29 +38,22 @@ skillcheck exits with code **1** when critical or high-risk skills are found, ma
63
38
  ```
64
39
 
65
40
  ```bash
66
- # Any CI pipeline
41
+ # Any CI system: machine-readable output, no color codes
67
42
  npx @mondoohq/skillcheck --json --no-color
68
43
  ```
69
44
 
70
- ### Other Install Methods
71
-
72
- ```bash
73
- # Install globally via npm
74
- npm i -g @mondoohq/skillcheck
75
- ```
76
-
77
- Binaries for macOS, Linux, and Windows are also available on [GitHub Releases](https://github.com/mondoohq/skillcheck/releases).
45
+ It fails open: a skill the database hasn't analyzed yet shows as clean and never blocks you.
78
46
 
79
- ## Validate a skills repository
47
+ ### Ship a skills repository that agents can actually load
80
48
 
81
- Beyond scanning *installed* skills for threats, skillcheck can validate a skills
82
- **repository** you author against the [Agent Skills](https://agentskills.io/specification)
83
- and [AGENTS.md](https://agents.md/) specifications — handy as a CI gate for a skills repo:
49
+ If you publish skills, `validate` checks your repository against the
50
+ [Agent Skills](https://agentskills.io/specification) and [AGENTS.md](https://agents.md/)
51
+ specifications — catching bad skill names, oversized descriptions, and a missing
52
+ `AGENTS.md` or marketplace manifest before your users do.
84
53
 
85
54
  ```bash
86
- # Validate the current directory (or pass a path)
87
- npx @mondoohq/skillcheck validate .
88
- npx @mondoohq/skillcheck validate ./my-skills-repo --json
55
+ npx @mondoohq/skillcheck validate . # current directory
56
+ npx @mondoohq/skillcheck validate ./my-skills --json # any path, JSON output
89
57
  ```
90
58
 
91
59
  ```text
@@ -103,25 +71,39 @@ Repository contract (agents.md + marketplace)
103
71
  PASS 6 passed, 0 failed
104
72
  ```
105
73
 
106
- The rules are an embedded [MQL](https://mondoo.com/docs/mql/home/) policy
107
- (`internal/validate/policy/repo-contract.mql.yaml`), run by the same compiled-in engine
108
- as the scan — no external policy file or cnspec install. It exits **1** if any check
109
- fails. Because the policy is a standard cnspec bundle, `cnspec scan filesystem <repo> -f
74
+ It exits **1** if any check fails, so it drops straight into a skills repo's CI. The rules
75
+ are an embedded [MQL](https://mondoo.com/docs/mql/home/) policy
76
+ ([`repo-contract.mql.yaml`](https://github.com/mondoohq/skillcheck/blob/main/internal/validate/policy/repo-contract.mql.yaml)),
77
+ and because it is a standard cnspec bundle, `cnspec scan filesystem <repo> -f
110
78
  repo-contract.mql.yaml` runs the identical checks.
111
79
 
112
- ## What Gets Checked
80
+ ## How the scan works
113
81
 
114
82
  For each detected agent, skillcheck:
115
83
 
116
84
  1. Discovers installed skills, plugins, MCP servers, and rules
117
85
  2. Computes a SHA-256 content hash for each skill
118
- 3. Queries the [Mondoo skill database](https://mondoo.com/ai-agent-security/skills) for known threats
86
+ 3. Looks the hash up in the [Mondoo skill database](https://mondoo.com/ai-agent-security/skills)
119
87
  4. Reports findings with severity, summary, and a link to the full security report
120
88
 
121
- Skills that aren't in the database yet show as clean — skillcheck fails open, never blocks your workflow.
89
+ Only hashes are sent, never skill contents. See
90
+ [supported agents](https://github.com/mondoohq/skillcheck/blob/main/docs/supported-agents.md)
91
+ for where skillcheck looks for each agent.
92
+
93
+ ## Install
94
+
95
+ `npx` always runs the latest release. To keep it installed:
96
+
97
+ ```bash
98
+ npm i -g @mondoohq/skillcheck
99
+ ```
100
+
101
+ Standalone binaries for macOS, Linux, and Windows are on
102
+ [GitHub Releases](https://github.com/mondoohq/skillcheck/releases).
122
103
 
123
104
  ## Links
124
105
 
125
106
  - [Mondoo AI Agent Security](https://mondoo.com/ai-agent-security)
126
107
  - [Skill Database](https://mondoo.com/ai-agent-security/skills) — browse 1,200+ analyzed skills
127
108
  - [Security Checks](https://mondoo.com/ai-agent-security/checks) — 25+ threat categories
109
+ - [Supported agents](https://github.com/mondoohq/skillcheck/blob/main/docs/supported-agents.md)
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@mondoohq/skillcheck_windows_arm64",
3
- "version": "0.3.1",
3
+ "version": "0.3.2",
4
4
  "description": "skillcheck binary for win32 arm64. Install @mondoohq/skillcheck instead.",
5
5
  "homepage": "https://github.com/mondoohq/skillcheck#readme",
6
6
  "repository": {
package/skillcheck.exe CHANGED
@@ -1,4 +1,4 @@
1
1
  [diffend] Oversized file quarantined before diffing.
2
2
  name: package/skillcheck.exe
3
3
  size: 82497024 bytes
4
- sha256: 898ca3105ca33fc94ac7ca33ba2a1214bd16812e2a1f9c876fb58d5fbe0d5672
4
+ sha256: c97d75d32b2e0f0e45609aaae04f3fe959e90b2a0d37fd121a4f387c564ea314