Complete skill package
Accepts pasted SKILL.md, multiple files, browser-selected folders and bounded ZIP archives without uploading them.
Loading…
Local-first Agent Skill supply-chain review
The browser worker parses text and bounded ZIP contents locally. It never follows links, starts a process, imports the skill or sends its contents to a model.
Coverage
Accepts pasted SKILL.md, multiple files, browser-selected folders and bounded ZIP archives without uploading them.
Surfaces hierarchy overrides, hidden comments, system-prompt extraction, invisible controls and encoded high-risk payloads.
Checks scripts for destructive operations, reverse shells, remote pipes, unsafe deserialization and shell interpolation.
Detects hardcoded credentials, sensitive-file access, explicit data transfer and cross-file secret-to-network capability.
Flags unconfirmed side effects, financial execution, privilege escalation, startup changes, memory poisoning and self-modification.
Builds a file inventory, resolves local references and reviews missing or hidden scripts, mutable dependencies and external destinations.
Returns stable rule IDs, severity, confidence, fingerprints, exact locations, remediation and SARIF-compatible output.
Local package scanner
The fastest paste workflow remains available, but package review is the security baseline: optional scripts and references are part of what an agent can load or execute. ZIP processing stays inside a bounded browser worker and rejects unsafe paths before producing a report.
| Surface | Static coverage | Available from |
|---|---|---|
| SKILL.md | Frontmatter, activation scope, prompt integrity, permissions, side effects and direct references. | Pasted file, folder or ZIP |
| scripts/ and text code | Command execution, remote pipes, destructive operations, unsafe deserialization, interpolation, secrets and persistence. | Folder or ZIP |
| references/ and assets/ | Referenced text, hidden instructions, external hosts, missing paths and progressive-disclosure depth. Binary files are inventoried only. | Folder or ZIP |
| Dependency manifests | Mutable package sources, unpinned dependencies and install-time lifecycle execution. No live CVE or publisher lookup. | Folder or ZIP |
| ZIP boundary | Absolute paths, parent traversal, ambiguous normalized names, file count and bounded decompression limits. | ZIP |
Open Agent Skills standard
Format checks follow the open Agent Skills specification. Security checks are Assetzaar review heuristics layered on top of that format; they are not part of the specification itself.
| Signal | Published constraint | Scanner treatment |
|---|---|---|
| name | 1–64 lowercase letters, numbers or single hyphens | Required format check; directory match needs repository review |
| description | 1–1,024 characters; what it does and when to use it | Length gate plus activation-scope advisory |
| compatibility | Optional, maximum 500 characters | Advisory when the published limit is exceeded |
| Main file | Under 500 lines and about 5,000 instruction tokens recommended | Low-severity progressive-disclosure warning |
| allowed-tools | Optional and experimental | Broad shell or wildcard pre-approval is flagged |
Threat model
Overrides higher-priority instructions or requests hidden system and developer messages.
Reads, prints, collects or transmits credentials, local identity files, cookies or environment values.
Deletes data, rewrites disks, resets repositories or drops database objects without a bounded target.
Pipes network responses into shells or dynamically decodes and evaluates hidden payloads.
Creates cron jobs, scheduled tasks, login agents, startup entries or enabled services.
Requests unrestricted shells, elevation, security-control bypass or unconfirmed external side effects.
Modifies persistent agent instructions, skill files or memory so later tasks inherit unreviewed behavior.
Pulls public or user-controlled material into agent context where indirect prompt injection can redirect tools.
Security framework mapping
Rule IDs are Assetzaar identifiers. Framework mappings help triage and communicate the risk; they do not turn a heuristic match into formal compliance or proof of malicious intent.
| Risk family | Reference | Scanner evidence |
|---|---|---|
| Prompt injection | OWASP LLM01 | Hierarchy overrides, hidden comments, prompt extraction and indirect untrusted-content signals. |
| Sensitive information disclosure | OWASP LLM02 | Hardcoded credentials, secret-file access, explicit exfiltration and cross-file source-to-network review. |
| Supply chain | OWASP LLM03 | Remote execution, mutable dependencies, hidden scripts, unsafe references and external destinations. |
| Excessive agency | OWASP LLM06 | Broad tools, privilege, destructive commands, financial actions, side effects and scope mismatch. |
| Persistence and command execution | MITRE ATT&CK / ATLAS | Startup changes, memory poisoning, shell execution, self-modification and AI supply-chain compromise signals. |
These sources define the file format and how Codex discovers and loads skills. Assetzaar’s threat rules are an independent defensive review layer.
Transparent scoring
FAQ
No. SKILL.md, scripts, references and manifests are handled as inert local text. The scanner never imports the skill, starts a process, follows a URL or sends content to a model.
No. Decompression and analysis occur in a browser worker. Saved reports and SARIF omit source excerpts; bounded excerpts in JSON, Markdown and CSV are an explicit opt-in.
It rejects absolute, parent-traversal, control-character and ambiguous paths before use, and enforces limits for compressed size, extracted bytes, file count and individual text files. Archive metadata and symlink targets still require repository review.
No. It means no covered pattern matched at a higher risk level in the supplied files. Novel attacks, runtime behavior, binaries, dependency ownership and social context can still change the outcome.
Prompt hierarchy overrides, credential exfiltration, destructive defaults, reverse shells, remote code piped to a shell, encoded malicious payloads, unsafe archive paths and unexplained self-modification should block installation.
Yes, when you select the full folder or ZIP. Supported text files are scanned and binary assets are inventoried without execution. Symlink targets, signatures, repository history and live vulnerability databases remain outside this local scan.
The SARIF 2.1.0 export includes stable rule IDs, locations, severities and fingerprints suitable for review in SARIF-compatible tooling. This browser page does not itself push results or modify a repository.