A skill is a file of instructions your AI agent follows. A bad one can take over the agent, send your files away, or collect your passwords. SkillCanary checks every skill before your agent reads it, and installs it only when you say yes.
Try the early warning
The demo checks locally for instruction overrides, hidden persistence, credential access, exfiltration, obfuscation, and related attack signals.
Demo runs a subset of SkillCanary's deterministic checks in your browser. The download runs every check, plus the isolated classifier on your own Claude or API account.
Defense in depth
A pattern scanner catches known attack wording and anything that runs code. A separate AI model, cut off from tools and files, catches attacks written in new words. Either one can stop an install; neither can approve one alone.
Reads every file without running or obeying any of it. A skill cannot talk it out of a finding.
A fresh model session with no tools, no memory and no access to your files, running on your own Claude or API account. It may answer only in a fixed format.
Field report · 2026-09-26
We ran SkillCanary's deterministic layer across 100 public skills: 20 official Anthropic, 15 obra/superpowers, and 65 wshobson/agents.
All 15 unsafe scores were driven by documentation-URL volume—not live threats. The most-flagged skill was Anthropic's own official claude-api skill (score 236), almost entirely from documentation links. That is calibration evidence, not a breach report.
The read: this sample produced no findings in those eight categories. That does not establish that these skills—or the wider supply chain—are safe. SkillCanary pairs deterministic checks with a separate isolated classifier workflow to support human review.
Installing a skill
Your agent passes the link to SkillCanary and learns only the outcome. It never reads the skill.
Protection levels
Setup asks which level you want and recommends one. You can change it any time, and canary doctor tells you what your Mac is protected against.
Nothing changes on your Mac. Your agent can still install skills other ways.
Claude Code and Codex block agents from installing skills or plugins any other way and point them to SkillCanary. A command written to hide its target can still get past a guard; Lockdown closes that.
Your Mac itself refuses changes to your skill folders from anything but SkillCanary, including scripts inside approved skills. Plugin updates go through canary update. For Lockdown, install with the Mac installer: it keeps SkillCanary where only your password can change it.
Set up SkillCanary
For Macs with Claude Code or Codex. Linux and Windows support is planned, and contributors are welcome. Both ways install the same canary command, then setup asks which protection level you want. Guard and Lockdown ask for your Mac password in the standard macOS window; your agent never sees it.
Developer-signed and notarized by Apple. Open it, follow the steps, then follow the two next steps. If your Mac asks to install Apple’s command-line developer tools the first time, choose Install; SkillCanary runs on the Python they include.
brew tap abeburnett/tapbrew trust abeburnett/tapbrew install skillcanarycanary setupInstall SkillCanary for me: run brew tap abeburnett/tap, brew trust abeburnett/tap and brew install skillcanary, then canary setup. Don’t open or read any skill files.
Works in the Claude desktop app’s Code tab and in the Codex desktop app. Ordinary chat can’t run commands. No Homebrew? Use the Mac installer.
Simple pricing
Everything that protects your own Mac is free.
canary add for any GitHub skill linkA flat team subscription with personal setup help, GitHub pull-request scan gates, and locally held policy and scan records. We help you provision your team after purchase.
Explore Team early access →A manually reviewed, publicly verifiable record for a specific skill version. Publisher verification and both scan layers are required; payment does not guarantee approval.
See the badge review process →