# Bastionskill

> Updated 2026-09-18 · type: tool · category: mcp-agents · status: active · rev 1

Bastionskill statically scans an agent skill before you install it, flagging hidden egress, secret theft and persistence, without ever running its code.

- Open source: yes (MIT)
- Self-hostable: yes
- Pricing model: free
- Best for: Anyone installing agent skills from other people (Claude Code, Codex, MCP skills) who wants a pre-flight check that a skill is not smuggling a keylogger or a data-exfil call, before it ever runs on their machine.
- Last verified: 2026-09-18

- **Canonical:** https://gtmstacker.com/registry/tool/bastionskill/
- **Source:** [github · Rinkia/bastionskill](https://github.com/Rinkia/bastionskill)
- **Tags:** mcp-agents, agent-security, supply-chain, static-analysis, self-hostable
- **Repository:** https://github.com/Rinkia/bastionskill

## Is Bastionskill open source?

Yes, Bastionskill is open source under the MIT license.

## How much does Bastionskill cost?

Bastionskill is free to use.

## Can I self-host Bastionskill?

Yes, Bastionskill can be self-hosted (the source is available under the MIT license).

## Alternatives & related

- [Bumblebee](https://gtmstacker.com/registry/tool/bumblebee/)
- [Talos](https://gtmstacker.com/registry/tool/talos/)


---

MIT skill-poisoning scanner (Python) that reads an AI-agent skill before you install it and flags malicious bundled code: hidden network egress, secret theft, hook-install persistence, destructive commands, obfuscation, opaque binaries, and SHADOW capabilities the SKILL.md never declared. It is static analysis only, the skill's own code is never executed. It installs via pip with zero required dependencies, and scans a local skill, a directory, or a remote owner/repo, returning allow, review or block.

## Provenance

- MIT, v0.2.0, zero required dependencies, and static-only analysis independently verified via the repo and PyPI (WebFetch 2026-09-18, maintainer Stefano Rizzello, github.com/Rinkia/bastionskill).
- Surfaced via the 2026-09-18 daily pull (Show HN: "scan an AI agent skill for malicious code").
- Curated from the GTM Stacker signal registry (2026-09-18 pass); license independently verified 2026-09-18.

## Why it matters for a GTM stack

Skills are the new install target, and installing one runs someone else's code with your agent's reach. Bastionskill is the pre-flight check for that: point it at a skill before you add it and it flags the egress call, the secret read, or the capability the SKILL.md never mentioned, all without executing the code. Paired with the rest of the agent-security stack this registry tracks, it slots in before the skill ever runs, where a manager keeps skills versioned and a kernel gates them at runtime. The honest read: static analysis catches patterns, not everything, so a clean scan means nothing matched, not that it is safe, and this is one young scanner among several. As a thirty-second habit before you trust a stranger's skill, it earns its place.