AI Skill Scanner: check agent skills before your agent runs them
Drop a ZIP of your skills or paste a SKILL.md. It flags hidden instructions, secret stealers, curl | sh loaders and invisible characters, with the exact line and a plain explanation.
1Ask your agent to zip its skills
Paste this into Claude Code, Codex, Cursor or any agent:
2Drop the ZIP here
3Read the report
One table for the whole pack, worst files first. Each finding shows the line, what it means, and where the pattern was documented.
Dangerous Suspicious Clean
Harmless test skills (fake domains ending in .invalid). Click one to see a report.
Why skills need checking
A skill is a set of instructions your agent follows with your files, keys and accounts. In VirusTotal’s study of 35,878 skills, most malicious ones didn’t contain any malware a classic antivirus could find: the attack was a sentence.
How attackers hide instructions
In 90 of the 6,637 malicious skills (1.4%) the payload was hidden from reviewers: after 78 to 825 blank lines, inside HTML comments that GitHub and previews don’t show, or in invisible Unicode characters. The agent reads the raw file, so it sees what you don’t. The scanner reads the raw file too and shows invisible characters as visible labels, like U+200B.
What the scanner checks
- Known indicators from VirusTotal reports: domains, email addresses, author names, file names and sample hashes.
- Instructions that leak data: send keys or tokens to an address, BCC every email, “don’t tell the user”.
- Takeover attempts: ignore previous instructions, text telling scanners to mark the skill safe, writing to the agent’s persistent memory, loading new instructions from the internet, redirecting LLM traffic.
- Dangerous code:
curl | sh, decoded-then-executed blobs, reverse shells, rogue SSH keys, collecting all environment variables and posting them out, bundled executables, password-protected archives. - Hidden text: long blank-line runs, HTML and Markdown comments, zero-width, text-direction and Unicode tag characters. Anything risky found inside hidden text is rated one level worse.
How to read the verdict
Dangerous matches a known indicator or a pattern with no honest use, such as hidden exfiltration. Don’t install it. Suspicious means read the flagged lines: official installers also use curl | sh. Clean means no rule matched; items marked Look are ordinary things like sudo or a mention of ~/.ssh that are worth a glance but don’t change the verdict.
Limits, honestly
This is a rule-based first pass. VirusTotal’s benchmark found that open-source skill scanners at default settings missed 36% to 71% of malicious skills while flagging 21% to 61% of clean ones, because rules can’t reliably tell documentation from an attack. A reworded instruction can slip past any rule. The scanner doesn’t run code or open links, and it can’t see what a skill downloads later, so scan again after every update and check important packages on VirusTotal as well.
FAQ
What is an AI agent skill?
A skill is a folder with a SKILL.md file of plain-language instructions, sometimes with scripts, that an AI agent such as Claude Code, Codex, Cursor or OpenClaw loads to learn a task. The agent follows those instructions with your files, keys and accounts, so a skill deserves the same care as any code you install.
How common are malicious skills?
VirusTotal analyzed 35,878 skills submitted to it and classified 6,637 (18.5%) as malicious; 52.9% carried some security or abuse risk. In 62.0% of the malicious ones there is no malicious code at all: the attack is written as instructions the agent follows. A separate academic study (Agent Skills in the Wild, arXiv 2601.10338) analyzed 31,132 skills from two marketplaces and found at least one vulnerability in 26.1% of them, with 5.2% showing high-severity indicators of malicious intent.
Are my files uploaded anywhere?
No. The page reads your ZIP or text with JavaScript inside your browser tab. Nothing is sent to a server, there is no account, and the scanner keeps working if you go offline after the page has loaded.
What does the scanner look for?
Indicators published by VirusTotal (malicious domains, addresses, author names and sample hashes), plus patterns from the research: instructions to send keys or BCC documents out, “don’t tell the user”, attempts to override rules or fool scanners, curl | sh installers, encoded code that gets executed, reverse shells, rogue SSH keys, LLM traffic redirection, instructions loaded from the internet, and text hidden after long runs of blank lines, inside HTML comments or in invisible Unicode characters.
Does “Clean” mean a skill is safe?
No. It means none of our rules matched. Rule-based checks can be reworded around, and VirusTotal notes that rules cannot reliably tell documentation from attacks. Treat “Suspicious” as “read this line”, not as proof of malware, and treat “Clean” as “no known red flags”. For a second opinion, check the package on VirusTotal.
How do I check all my skills at once?
Ask your agent to zip every skills folder it loads into one file, then drop that ZIP here. You get one table for the whole pack, worst files first, and a detailed report for each file.
How do I stay safe with agent skills?
Following VirusTotal’s advice: review SKILL.md and bundled scripts before installing, including long files with suspicious blank space; install from sources you trust and pin versions; avoid skills that ask you to run curl | sh or download extra tools; keep cloud credentials, SSH keys and .env files out of the agent’s workspace; and scan again after every update.
Sources
- VirusTotal, From Automation to Infection (Part III): Naming, Measuring, and Detecting Malicious AI Agent Skills, Oct 8, 2026.
- VirusTotal, How Some Malicious AI Skills Hide Instructions from Reviewers, Oct 21, 2026.
- VirusTotal, From Automation to Infection: How OpenClaw AI Agent Skills Are Being Weaponized, Feb 2, 2026.
- Liu et al., Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale, arXiv 2601.10338.
AI Skill Scanner is an independent tool and is not affiliated with VirusTotal or the paper’s authors. Rules version .