What it does

Static supply-chain risk scan of a Claude Code skill BEFORE you install it. A marketplace skill is just code that runs with your permissions; this reads its files (no execution) and flags network egress to unknown hosts, reads of SSH keys / .env / cloud creds / browser cookies, eval/exec and base64-to-exec obfuscation, curl-pipe-to-shell droppers, recursive deletes, settings/hook tampering, and persistence, returning a fail-closed low/medium/high/critical verdict.

Use BEFORE installing a downloaded or marketplace skill, to audit skills you already have, or as the install gate inside ClevSkill.

How it arrives

You don't install skills one by one. ClevskillSetup installs the whole curated pack, wires the safety hooks, and verifies each skill actually runs on your machine. The weekly health scan re-checks it from then on, and repairs route through your approval.

Setup

No setup needed. It works as soon as the pack is installed; no accounts, no API keys, nothing leaves your machine.

Invoke it

In Claude Code or Claude Cowork, just ask in plain language; skills trigger on intent. Things people say that make this skill run:

you: is this skill safe
you: scan this skill
you: audit my skills for malware
claude: [skill-supply-chain-scanner runs, result returned with full audit log]

Part of the security suite: it runs automatically where it applies, fails closed on errors, and never sends your content anywhere.