SOVEREIGN · SINGLE BINARY ● v0.1.0

SKILLHAWK

The install-gate for AI agent skills & MCP servers. Before a skill ever runs, SkillHawk pulls the bundle apart and hunts what's hiding inside — remote-bootstrap loaders, secret-exfiltration flows, weaponised dependencies, prompt-injected instructions — then returns one verdict: SAFE or DO NOT INSTALL. Explainable to the exact file:line. Runs fully offline — no cloud, no telemetry, no trust required.

Pure Rust engine Python + JS AST YARA-X + OSV.dev x86-64 Linux

Get via Portal → See the detection stack ↓

skh — scan verdict

$ skh scan ./suspicious-skill

CRITICAL loader.py:3  [AST8] exec() wrapping requests.get
CRITICAL loader.py:3  [TT5]  taint: requests.get → exec
CRITICAL run.py:3     [TT3]  taint: os.environ → requests.post
    HIGH hook.js:4    [SC2]  Remote Code Execution
    HIGH SKILL.md:9   [P3]   External Transmission Instructions
    HIGH loader.py:3  [YR1]  YARA: remote_bootstrap_execution
    HIGH requirements [SC4]  pycrypto — 5 known CVEs
              GHSA-6528-wvf6-f6qg, PYSEC-2012-16 …

  VERDICT: DO NOT INSTALL   risk 100/100
  exit 1 — drops straight into CI gating

// detection

Six ways in. One verdict.

Six independent layers dissect every file in the bundle in parallel, each blind to the others, then converge on a single 0–100 risk score. No single trick to evade — a payload that dodges the regex still trips the syntax tree, the data-flow tracer, the malware rules, or the dependency check.

🧬

Pattern Corpus · 460 signatures

Curated detection rules under a real regex engine with lookaround & backreferences — remote code execution, credential theft, data exfiltration, prompt injection, and conversation-context leaks.

🌳

AST Analysis · Python + JS

tree-sitter parses code into real syntax trees, not text. Catches exec/eval, dynamic import, and dangerous call chains that grep-based scanners walk straight past.

🩸

Taint Engine · data-flow

Tracks tainted data across variables: env / secrets → network and network → exec. Surfaces the multi-step exfiltration and remote-bootstrap flows a single pattern never sees.

🦠

YARA-X Rules · malware

Pure-Rust YARA signatures for known-bad families — remote-bootstrap loaders, staged droppers, and obfuscation packers — matched byte-for-byte across the whole bundle.

🔗

Dependency CVEs · live OSV

Every declared dependency checked against OSV.dev — a skill that quietly pins a vulnerable pycrypto or numpy is flagged with real GHSA / PYSEC IDs before you inherit its holes.

📒

Rug-Pull Ledger · over time

SkillHawk remembers each skill's fingerprint. When a package that scanned clean yesterday mutates on update — the classic supply-chain rug-pull — it screams instead of shrugging.

// sovereign by design

Trust nothing. Not even us.

A tool that decides whether code is safe to run can't itself phone home. SkillHawk is one static binary with the whole engine inside it — scan an air-gapped review box, a CI runner, a laptop on a plane.

One binary, zero cloud

Pure Rust, single static executable. The 460-pattern corpus, the AST parsers, the YARA rules — all baked in. No install-time downloads, no runtime service, no data leaves the box.

Fail-closed AI meta-filter

Optionally, Newton's brain reviews borderline findings to trim false positives — but it can only ever reduce noise, never hide danger. Every CRITICAL and HIGH survives the filter even if the model disagrees.

Three ways to run

scan a skill by hand, serve it as an MCP install-gate that auto-vets skills your agent is about to install, or let it update itself. Terminal, JSON, or SARIF output.

// from bundle to verdict

Vetted in four steps.

STEP 01

Point it

Give it a skill — a directory, a .zip, or a single file: skh scan ./skill.

STEP 02

It dissects

The bundle is unpacked and every file run through all six layers in parallel — no network, no execution of the target.

STEP 03

One verdict

A 0–100 risk score and a SAFE / REVIEW / DO NOT INSTALL disposition, every finding tagged to file:line with a rule ID.

STEP 04

Gate it

Run skh serve as an MCP install-gate — your agent auto-scans and refuses anything dangerous. Exit code drops into CI.