skillock 🔒

Install AI agent skills without wondering what they will read, run, or change.
Scan untrusted skills before they touch secrets, shell, or your agent directories.

User pains skillock solves

• a skill reads .env, ~/.ssh/, or tokens during install
• a skill runs exec, curl | sh, or destructive shell commands
• an update changes files and you cannot see what drifted
• the same vetted skill needs to land in multiple agents without manual copy/paste

Features

• 🔒 Scan-before-install — 19 security rules (9 P0, 6 P1, 4 P2) check every file
• 🔐 Supply-chain integrity — TOML lockfile with SHA-256 of every file
• 🚫 Zero trust — P0 rules block install; P1 prompts; P2 notes only
• 🔄 Symlink deploy — clean, reversible installation into agent directories
• 🏷️ Pinned versions — resolves tags/commits/branches to immutable SHA
• 🧩 Multi-agent — supports Claude, Codex, Agents, Cursor (or --agents all)
• 📦 Zero runtime deps — Python ≥3.11, stdlib only (tomllib, hashlib, subprocess, pathlib)
• 🛡️ MIT licensed

Install

# preview a skill without writing anything
uvx skillock add owner/repo --skill my-skill --agents claude,codex --dry-run

# one-off install (no global install needed)
uvx skillock add owner/repo --skill my-skill --agents claude,codex

# or install globally
uv tool install skillock

Commands

Use skillock when

• you already found a skill and want to vet it before install
• you want Git-pinned, SHA-verified skill installs
• you want one vetted skill deployed to multiple agents
• you want a local-first workflow with no hosted registry dependency

What skillock is not

• not a registry or marketplace for discovering skills
• not a publishing platform for skill authors
• not a general sync layer for every skills workflow

What Gets Blocked (P0 — Install Refused)

• curl-pipe-shell — curl ... | sh, wget ... | bash
• destructive-rm — rm -rf /, rm -fr, rm -Rf
• sudo / privilege escalation — sudo, su, doas
• code execution — eval(), exec(), Function(), os.system(), subprocess(..., shell=True)
• pickle deserialization — pickle.load(), pickle.loads()
• credential reads — .env, ~/.ssh/, AWS_SECRET, GH_TOKEN, etc.
• hardcoded secrets — API keys, tokens, passwords in source

P1 warns and asks for confirmation; P2 prints notes only.
Full rule table: docs/spec.

Quick Demo

# This skill reads .env and uses exec() — BLOCKED (18 P0 findings)
uvx skillock add obra/superpowers --skill brainstorming --agents agents --yes

# Clean skill — installs successfully
uvx skillock add obra/superpowers --skill test-driven-development --agents agents --yes

Actual blocked run against obra/superpowers:

How It Works

1. Resolve — GitHub repo + tag/commit/branch → pinned commit SHA
2. Clone — shallow clone at pinned ref
3. Scan — every file checked against 19 security rules (9 P0, 6 P1, 4 P2)
4. Gate — P0 blocks install; P1 prompts; P2 notes
5. Deploy — symlinks into agent directories (~/.claude/skills/, ~/.codex/agents/, etc.)
6. Lock — TOML lockfile with SHA-256 of every file for integrity verification

Supported agents: claude, codex, agents, cursor (or --agents all)

Why

Most tools in this space optimize for discovery, sync, or publishing. skillock optimizes for one narrower job: stop untrusted skills before install, then pin and lock what passed.

Real incidents show skills are untrusted code:

• A polars skill shipped adversarial instructions (K-Dense-AI/claude-scientific-skills)
• A hallucinated npm package spread to 200+ repos via copy-pasted skills

Skills are prompts your agent executes — treat them like untrusted code.

Architecture

• Zero runtime dependencies — Python ≥3.11, stdlib only (tomllib, hashlib, subprocess, pathlib)
• POSIX — Linux, macOS, WSL
• MIT license

Links

• GitHub: https://github.com/ruslanlap/skillock
• PyPI: https://pypi.org/project/skillock/
• Security policy: SECURITY.md
• Contributing: CONTRIBUTING.md
• Changelog: CHANGELOG.md