saferskills.ai ·
Methodology ·
Discussions ·
Slack ·
Security
See it in 15 seconds
Quick start
No install needed — npx runs the prebuilt native binary:
npx saferskills info mcp-server-github # score, four-axis breakdown, findings & report URL
npx saferskills install mcp-server-github # install to your detected agents — score re-checked, severity-gated
npx saferskills capability ./my-skill # scan a local file/dir — or a public GitHub URL
npx saferskills agent # behaviorally scan a running agent against ~20 adversarial tests
Prefer it installed? npm install -g saferskills or cargo install saferskills. No terminal at all? Everything the CLI does is in your browser at saferskills.ai — browse the catalog, scan a capability, or run a behavioral agent scan, with no account and nothing to install. Full command + flag reference: cli/README.md.
SaferSkills is v0.x, built in the open — the catalog is filling in as ingestion scales toward the public launch.
Why this exists
You install a Claude skill, an MCP server, a Cursor rules file, or a Codex hook. It runs with your file-system access. It can read your .env. It can curl | bash. It can quietly ship your repo to a paste site. And across the tens of thousands of such items now circulating, there is no public, transparent record of what each one actually does.
SaferSkills is that record. Anyone — a developer, a vendor, a researcher — submits a GitHub URL (or uploads a file), and a ~30-second deterministic scan returns a Yuka-style report: an aggregate trust score (0–100), a four-axis breakdown, every detector that fired, the rule that fired it, the exact line of evidence, the remediation, and a permalink the vendor can dispute.
Methodology, not opinion. Every rule is documented. Every score is reproducible. Every appeal is public.
How it works
The verdict path is fully deterministic — there is no LLM deciding your score. Every finding carries a static rule_id and a quotable line of evidence, so a verdict is reproducible from the trace alone. The result is a public report permalink:
Trust-score rubric
| Tier | Range | Meaning |
|---|
| 🟢 Green | 80–100 | Indexed, signed, behaviorally clean, provenance-verified |
| 🟡 Yellow | 60–79 | Known author, no critical findings, some lower-severity flags |
| 🟠 Orange | 40–59 | Anonymous author or mid-severity finding or provenance unclear |
| 🔴 Red | 0–39 | Critical finding — prompt injection / shell RCE / secret exfil / supply-chain |
Sub-scores are weighted: Identity 25% · Integrity 25% · Behavior 30% · Provenance 20%. A single critical finding floors the aggregate into the red tier regardless of the other axes. Full rubric and every detection rule → saferskills.ai/methodology.
Use it as
| Mode | Best for | Status |
|---|
Service — browse saferskills.ai, share a report permalink | every dev, every researcher | live — catalog + scan reports |
CLI — npx saferskills install <name> (score re-checked at install) | individual installers | shipped — npm + crates.io |
Self-host — docker compose up (this repo) | privacy-strict / air-gapped orgs | scan engine shipped |
Screenshots
Works across 8 agents
One trust layer for every coding agent. Detect, install, and re-verify across:
claude-code · cursor · windsurf · copilot · codex · gemini · cline · openclaw
Teach your agent to use SaferSkills
One command teaches any of the 8 supported agents to use SaferSkills — and to scan a
capability before it installs, adds, recommends, or trusts it:
npx saferskills install saferskills
The canonical skill lives at skills/saferskills/SKILL.md and
renders to each agent's native format (Claude Code & OpenClaw get the SKILL.md verbatim;
Cursor .mdc, Cline/Windsurf rules, Codex/Copilot AGENTS.md, Gemini GEMINI.md get a
native render). See the install guide.
⭐ Support the project
If SaferSkills helps you install AI capabilities more safely, star the repo — it's the cheapest way to help a free, public safety service reach the people installing risky skills. Stars are how this gets in front of the next developer about to curl | bash something they didn't read.
Community
- 💬 Discussions — questions, ideas, show-and-tell.
- 🐛 Issues — bugs and feature requests.
- 📐 Rule proposals — propose a new detection rule (RFC required before any rule lands).
- ⚖️ Vendor appeals — dispute a verdict about an item we scanned. Every verified appeal gets a substantive public response within 1 hour.
Develop
git clone https://github.com/OpenLatch/saferskills.git
cd saferskills
pnpm install
pnpm run generate # 9 generators: ingestion registry + Pydantic + SQLAlchemy + openapi.json + TS DTO + Zod + methodology + agent-pack
docker compose up # postgres + api + webapp
curl http://localhost:8000/api/v1/health
open http://localhost:5173
Requirements: Node 24 LTS, Python 3.14, pnpm 10, uv 0.7+, Docker.
Repo map
| Path | What it is | Docs |
|---|
cli/ | The saferskills Rust CLI — install + capability/agent scans | README |
ui/ | Design system — React 19 + Tailwind v4 tokens & components | README |
webapp/ | Astro 7 public site — catalog, scan/agent reports, docs | README |
services/api/ | FastAPI backend — catalog, scan engine, ingestion | README |
services/worker/ | Procrastinate ingestion + bulk-scan worker (same image as the API) | README |
schemas/ | JSON Schema source-of-truth for every wire/DB/type contract | README |
rubric/ | The open, versioned detection-rule rubric | README |
scripts/ | The codegen pipeline (pnpm run generate) | dir |
tools/ | Dev + ops tooling | data-seed · · · |
Contributing
We welcome contributions — code, detection-rule RFCs, scan-report appeals, and translations. Read CONTRIBUTING.md, the Code of Conduct, and the methodology summary first. Detection-rule proposals go through the rule-RFC issue template — don't land a rule without one.
Security
License
Apache License 2.0 — see LICENSE. An OpenLatch project.
