Security scanner for AI agent skills. Detects hardcoded secrets, unsafe code execution, prompt injection, and malware patterns in under 50ms. Scan before you...
Documents
ViBo SkillQA
Try itTest and certify AI agent skills: 7 automated checks, grade A–D, certificate. Use when asked to check, test, review, or certify a skill before publishing. Use ONLY with the user's explicit consent: SkillQA reads the skill folder (incl. .env-like files, for masked secret findings), checks local skill-library metadata for novelty, writes reports locally and a machine-bound license file — tell the user what will be scanned and where reports are saved.
What it does
Test and certify AI agent skills: 7 automated checks, grade A–D, certificate. Use when asked to check, test, review, or certify a skill before publishing. Use ONLY with the user's explicit consent: SkillQA reads the skill folder (incl. .env-like files, for masked secret findings), checks local skill-library metadata for novelty, writes reports locally and a machine-bound license file — tell the user what will be scanned and where reports are saved.
The skill document
ViBo SkillQA
Local-first. No telemetry, no cloud sync — tested skills and reports never leave your machine.
Autonomous QA and certification for agent skills (a folder with SKILL.md
- helper scripts). Runs 7 automated checks, grades the skill A–D and issues a certificate you can show to buyers or feed to CI (JSON).
Commands (run from the skillqa folder)
python3 skillqa.py test [--lang en|ru] [--skip module1,module2] [--load N] [--parallel [N]] [--timeout S]
python3 skillqa.py selftest # test the tester itself
python3 skillqa.py license --status # license state (demo vs pro)
- demo: static scan + teaser report (free, no license needed)
- pro: all 7 modules + certificate + JSON for CI (license key, $5/month, trial 2 days — https://wwwvibo.com)
When to use
- User asks to check, test, review, or certify a skill.
- Before publishing a skill to a marketplace — run the check, show the grade.
- After editing a skill — re-run to prove nothing broke.
- Use only with the user's explicit consent: testing reads the skill folder and executes its scripts in a sandbox. Tell the user what will be scanned and where reports are saved before running.
Privacy, consent, retention & deletion
| What | Where | How to delete |
|---|---|---|
QA reports (.md/.json) | qa_reports// next to the tester | delete the folder |
| License file | ~/.config/skillqa/skillqa_license.dat | rm the file |
| Sandbox copies of the tested skill | temp dir, removed after each run | automatic |
- No telemetry, no cloud sync, no data leaves your machine.
- Reports only store findings (pass/warn/fail, file:line), never secret values found inside a tested skill — a leaked secret is reported as a finding, not echoed.
- All executables run in a sandbox: fake tokens, no network, hard timeouts.
- Never run a skill's scripts outside the sandbox.
Permissions
- Files: reads the tested skill folder; writes
qa_reports/and~/.config/skillqa/only. - Process: runs tested skill scripts inside a sandbox (unshare -n, timeout, kill) — never as the calling agent.
- Network: none (sandbox runs with network disabled).
- Secrets: never read, logged or sent; only flagged as a finding.
License (important!)
This skill is commercial. Demo mode is free (static scan + teaser report); full certification (7 modules, grade, certificate, JSON) requires a valid ViBo SkillQA license — see https://wwwvibo.com. The registry listing carries the platform default license (MIT-0) which covers the hosted showcase copy only; the product itself is licensed per the terms above.
Related skills
Agent skill quality checker. Input a skill directory or skill files; output trigger clarity, metadata issues, examples, safety boundaries, installability, po...
36 installs
Automated security audit for AI agent skills. Use BEFORE installing any skill from ClawHub, GitHub, or other sources. Scans SKILL.md + all files for 30+ red...
by Zoran2 installs
Audit installed AI agent skills against the OWASP Agentic Skills Top 10 and emit text, JSON, SARIF, or HTML reports.
29 installs1 stars
Scan skills in a project directory for security issues and generate a markdown table report, then install skills from a local registry. Combines static analysis of code and markdown files with supply chain checks. Use when auditing a skills directory, generating a security summary table, or installi
Audit a target SKILL.md against the Agent Skills specification and generate a Chinese HTML report. Use when the user asks to check, audit, review, or optimiz...
21 installs