{
  "$schema_doc": "https://gtmstacker.com/registry/schema/entry.schema.json",
  "stability": "emerging",
  "generator": "agentic-media-registry",
  "generated_at": "2026-09-18T00:00:00Z",
  "id": "com.gtmstacker.registry/tool/bastionskill",
  "type": "tool",
  "slug": "bastionskill",
  "canonical_url": "https://gtmstacker.com/registry/tool/bastionskill/",
  "title": "Bastionskill",
  "description": "MIT skill-poisoning scanner (Python, by Stefano Rizzello) that reads an agent skill before you install it and flags malicious bundled code: hidden network egress, secret theft, hook-install persistence, destructive commands, obfuscation, opaque binaries, and capabilities the SKILL.md never declared. Static analysis only, the skill's code is never run; installs via pip with zero dependencies (3.10+); scans a local skill, a directory, or a remote owner/repo. v0.2.0 returns allow / review / block.",
  "category": "mcp-agents",
  "tags": [
    "mcp-agents",
    "agent-security",
    "supply-chain",
    "static-analysis",
    "self-hostable"
  ],
  "status": "active",
  "revision": 1,
  "content_hash": "4acc1acbe9126972a09a57dfbdf1a4dcbd59897d9fc0455929152acdb5f7b137",
  "date_published": "2026-09-18T00:00:00Z",
  "date_modified": "2026-09-18T00:00:00Z",
  "source": {
    "name": "github · Rinkia/bastionskill",
    "url": "https://github.com/Rinkia/bastionskill"
  },
  "license": "MIT",
  "one_liner": "Bastionskill statically scans an agent skill before you install it, flagging hidden egress, secret theft and persistence, without ever running its code.",
  "open_source": "yes",
  "self_hostable": "yes",
  "pricing_model": "free",
  "who_its_for": "Anyone installing agent skills from other people (Claude Code, Codex, MCP skills) who wants a pre-flight check that a skill is not smuggling a keylogger or a data-exfil call, before it ever runs on their machine.",
  "aliases": [
    "bastionskill",
    "Bastion Skill"
  ],
  "alternatives": [
    "bumblebee",
    "talos"
  ],
  "secondary_categories": [
    "ai-infrastructure",
    "productivity-knowledge"
  ],
  "last_verified": "2026-09-18",
  "evidence": {
    "claim_type": "mixed",
    "source_id": "https://github.com/Rinkia/bastionskill",
    "note": "MIT, Python, v0.2.0, zero required dependencies, and static-only analysis ('the scanner reads source, it never runs it') confirmed via the repo and PyPI (WebFetch 2026-09-18; maintainer Stefano Rizzello, github.com/Rinkia/bastionskill). Detector list (egress, secret-read, persistence, destructive, obfuscation, opaque-binary, shadow capabilities) is the project's own; static analysis catches declared patterns, not every possible payload."
  },
  "caveats": "Static analysis flags known patterns, so treat a clean result as 'nothing matched the detectors', not 'proven safe'. Young project (v0.2.0), single maintainer, and one of several skill-scanners emerging (SkillSpector, Cisco and Snyk have their own); it is a fast pre-flight layer, not a full security program.",
  "lead": "MIT skill-poisoning scanner (Python) that reads an AI-agent skill before you install it and flags malicious bundled code: hidden network egress, secret theft, hook-install persistence, destructive commands, obfuscation, opaque binaries, and SHADOW capabilities the SKILL.md never declared. It is static analysis only, the skill's own code is never executed. It…",
  "chunks": [
    {
      "index": 0,
      "heading_path": [],
      "est_tokens": 127,
      "text": "MIT skill-poisoning scanner (Python) that reads an AI-agent skill before you install it and flags malicious bundled code: hidden network egress, secret theft, hook-install persistence, destructive commands, obfuscation, opaque binaries, and SHADOW capabilities the SKILL.md never declared. It is static analysis only, the skill's own code is never executed. It installs via pip with zero required dependencies, and scans a local skill, a directory, or a remote owner/repo, returning allow, review or block."
    },
    {
      "index": 1,
      "heading_path": [
        null,
        "Provenance"
      ],
      "est_tokens": 188,
      "text": "hook-install persistence, destructive commands, obfuscation, opaque binaries, and SHADOW capabilities the SKILL.md never declared. It is static analysis only, the skill's own code is never executed. It installs via pip with zero required dependencies, and scans a local skill, a directory, or a remote owner/repo, returning allow, review or block.\n\n- MIT, v0.2.0, zero required dependencies, and static-only analysis independently verified via the repo and PyPI (WebFetch 2026-09-18, maintainer Stefano Rizzello, github.com/Rinkia/bastionskill).\n- Surfaced via the 2026-09-18 daily pull (Show HN: \"scan an AI agent skill for malicious code\").\n- Curated from the GTM Stacker signal registry (2026-09-18 pass); license independently verified 2026-09-18."
    },
    {
      "index": 2,
      "heading_path": [
        null,
        "Why it matters for a GTM stack"
      ],
      "est_tokens": 286,
      "text": "zero required dependencies, and static-only analysis independently verified via the repo and PyPI (WebFetch 2026-09-18, maintainer Stefano Rizzello, github.com/Rinkia/bastionskill). - Surfaced via the 2026-09-18 daily pull (Show HN: \"scan an AI agent skill for malicious code\"). - Curated from the GTM Stacker signal registry (2026-09-18 pass); license independently verified 2026-09-18.\n\nSkills are the new install target, and installing one runs someone else's code with your agent's reach. Bastionskill is the pre-flight check for that: point it at a skill before you add it and it flags the egress call, the secret read, or the capability the SKILL.md never mentioned, all without executing the code. Paired with the rest of the agent-security stack this registry tracks, it slots in before the skill ever runs, where a manager keeps skills versioned and a kernel gates them at runtime. The honest read: static analysis catches patterns, not everything, so a clean scan means nothing matched, not that it is safe, and this is one young scanner among several. As a thirty-second habit before you trust a stranger's skill, it earns its place."
    }
  ],
  "alternates": {
    "markdown": "https://gtmstacker.com/registry/tool/bastionskill/index.md",
    "html": "https://gtmstacker.com/registry/tool/bastionskill/",
    "json": "https://gtmstacker.com/registry/tool/bastionskill/index.json",
    "server_json": "https://gtmstacker.com/registry/tool/bastionskill/server.json"
  },
  "jsonld": {
    "@context": "https://schema.org",
    "@graph": [
      {
        "@type": "WebSite",
        "@id": "https://gtmstacker.com/#website",
        "url": "https://gtmstacker.com/",
        "name": "GTM Stacker Agent Registry",
        "description": "A daily-updated, agent-native registry of open-source tool discoveries, tool updates, and curated news for the go-to-market / RevOps engineering niche. Machine-readable first: agents can discover, parse, page, and delta-sync it without scraping HTML.",
        "inLanguage": "en",
        "publisher": {
          "@id": "https://gtmstacker.com/#organization"
        }
      },
      {
        "@type": "Organization",
        "@id": "https://gtmstacker.com/#organization",
        "name": "GTM Stacker",
        "url": "https://gtmstacker.com",
        "description": "The growth-systems practice of Theo Popov: AI-native enrichment, outbound, content engines and internal tooling for startups and venture programs. Its agent-native media property, the GTM Stacker Agent Registry, maintains a daily-updated catalog of open-source go-to-market and RevOps tools that both people and AI engines can discover, compare, and cite.",
        "foundingDate": "2024-08",
        "knowsAbout": [
          "go-to-market engineering",
          "RevOps",
          "sales automation",
          "marketing operations",
          "open-source software",
          "AI agents"
        ],
        "founder": {
          "@type": "Person",
          "@id": "https://gtmstacker.com/#founder",
          "name": "Theo Popov",
          "jobTitle": "Growth Operations & GTM Systems",
          "url": "https://gtmstacker.com/about/",
          "sameAs": [
            "https://www.linkedin.com/in/theo-popov",
            "https://x.com/Theo_Popov",
            "https://github.com/theopopov"
          ],
          "worksFor": {
            "@id": "https://gtmstacker.com/#organization"
          }
        },
        "sameAs": [
          "https://www.linkedin.com/company/gtmstacker",
          "https://www.youtube.com/@gtmstacker",
          "https://www.instagram.com/gtmstacker/",
          "https://www.tiktok.com/@gtmstacker"
        ],
        "mainEntityOfPage": "https://gtmstacker.com/registry/about/"
      },
      {
        "@type": "SoftwareApplication",
        "@id": "https://gtmstacker.com/registry/tool/bastionskill/#software",
        "name": "Bastionskill",
        "identifier": "io.github.Rinkia/bastionskill",
        "description": "MIT skill-poisoning scanner (Python, by Stefano Rizzello) that reads an agent skill before you install it and flags malicious bundled code: hidden network egress, secret theft, hook-install persistence, destructive commands, obfuscation, opaque binaries, and capabilities the SKILL.md never declared. Static analysis only, the skill's code is never run; installs via pip with zero dependencies (3.10+); scans a local skill, a directory, or a remote owner/repo. v0.2.0 returns allow / review / block.",
        "applicationCategory": "DeveloperApplication",
        "url": "https://gtmstacker.com/registry/tool/bastionskill/",
        "datePublished": "2026-09-18T00:00:00Z",
        "dateModified": "2026-09-18T00:00:00Z",
        "isPartOf": {
          "@id": "https://gtmstacker.com/#website"
        },
        "license": "https://spdx.org/licenses/MIT.html",
        "codeRepository": "https://github.com/Rinkia/bastionskill",
        "keywords": "mcp-agents, ai-infrastructure, productivity-knowledge, agent-security, supply-chain, static-analysis, self-hostable",
        "author": {
          "@type": "Organization",
          "name": "Rinkia",
          "url": "https://github.com/Rinkia",
          "sameAs": [
            "https://github.com/Rinkia/bastionskill"
          ]
        },
        "offers": {
          "@type": "Offer",
          "price": 0,
          "priceCurrency": "USD"
        },
        "isSimilarTo": [
          {
            "@type": "SoftwareApplication",
            "name": "Bumblebee",
            "url": "https://gtmstacker.com/registry/tool/bumblebee/",
            "applicationCategory": "DeveloperApplication",
            "offers": {
              "@type": "Offer",
              "price": 0,
              "priceCurrency": "USD"
            }
          },
          {
            "@type": "SoftwareApplication",
            "name": "Talos",
            "url": "https://gtmstacker.com/registry/tool/talos/",
            "applicationCategory": "DeveloperApplication",
            "offers": {
              "@type": "Offer",
              "price": 0,
              "priceCurrency": "USD"
            }
          }
        ]
      },
      {
        "@type": "BreadcrumbList",
        "@id": "https://gtmstacker.com/registry/tool/bastionskill/#breadcrumb",
        "itemListElement": [
          {
            "@type": "ListItem",
            "position": 1,
            "name": "GTM Stacker Registry",
            "item": "https://gtmstacker.com/registry/"
          },
          {
            "@type": "ListItem",
            "position": 2,
            "name": "MCP Agents",
            "item": "https://gtmstacker.com/registry/category/mcp-agents/"
          },
          {
            "@type": "ListItem",
            "position": 3,
            "name": "Bastionskill",
            "item": "https://gtmstacker.com/registry/tool/bastionskill/"
          }
        ]
      }
    ]
  },
  "tool": {
    "name": "io.github.Rinkia/bastionskill",
    "repository": {
      "url": "https://github.com/Rinkia/bastionskill",
      "source": "github"
    }
  }
}