Bastionskill statically scans an agent skill before you install it, flagging hidden egress, secret theft and persistence, without ever running its code.
Yes, Bastionskill is open source under the MIT license.
Bastionskill is free to use.
Yes, Bastionskill can be self-hosted (the source is available under the MIT license).
MIT skill-poisoning scanner (Python) that reads an AI-agent skill before you install it and flags malicious bundled code: hidden network egress, secret theft, hook-install persistence, destructive commands, obfuscation, opaque binaries, and SHADOW capabilities the SKILL.md never declared. It is static analysis only, the skill's own code is never executed. It installs via pip with zero required dependencies, and scans a local skill, a directory, or a remote owner/repo, returning allow, review or block.
Skills are the new install target, and installing one runs someone else's code with your agent's reach. Bastionskill is the pre-flight check for that: point it at a skill before you add it and it flags the egress call, the secret read, or the capability the SKILL.md never mentioned, all without executing the code. Paired with the rest of the agent-security stack this registry tracks, it slots in before the skill ever runs, where a manager keeps skills versioned and a kernel gates them at runtime. The honest read: static analysis catches patterns, not everything, so a clean scan means nothing matched, not that it is safe, and this is one young scanner among several. As a thirty-second habit before you trust a stranger's skill, it earns its place.