Skip to content
pwnry. io
Start free
Pwnry Skill Scanner

Claude Code and Codex skills: inspect before installing.

Agent skills are reusable instructions that may include executable files. Treat a new skill as third-party code: inspect its contents, test with disposable data and limit the tools it can use. A package scan supplies evidence for that decision.

Five checks before you enable a skill.

  1. Fix the source and version

    Record where the skill came from, its license and the exact revision. A familiar name, a marketplace listing or many downloads do not establish what is inside this version. Keep the submitted package hash with the report.

  2. Read beyond SKILL.md

    Review referenced scripts, hooks, configuration and bundled binaries. Look for instructions to ignore existing rules, expose secrets or execute content that is not included in the package. Read linked local reference files as well.

  3. Question downloads and credential access

    Ask why the skill needs a shell, external downloads or access to cloud credentials and SSH keys. A string match is only an indicator. Compare the requested behavior with the task the skill is supposed to perform.

  4. Test away from real data

    Use disposable files and narrow permissions. For a Pwnry check, submit a ZIP without production secrets. Its selected execution runs without network access; remote dependencies and model-specific behavior remain outside that observation.

  5. Keep permissions narrow after installation

    Review sensitive tool calls and follow your agent's permission controls. Recheck updates and newly added dependencies. A report for one package version is not blanket approval for its future releases or every agent session.

An observation is not a verdict about intent.

A script may legitimately need a download. A credential reference may belong to documentation. Conversely, a package can look ordinary until a particular model, tool permission or remote dependency changes its behavior. Review evidence in context.

Pwnry combines static indicators with bounded isolated analysis of selected scripts and binaries. It records limitations rather than declaring unsupported content clean. Findings stay private unless you deliberately create a sharing link.

See the Skill Scanner

Read the original specifications.

The format and permission behavior depend on the agent and its version. These primary sources explain package structure and the respective agent integration. Pwnry is an independent service.

Good questions.
Clear answers.

What you should know before your first check.

What is an agent skill?+

An agent skill is a directory of reusable instructions with a SKILL.md file. It can also contain scripts, reference material and other files. The agent reads the instructions and may use its own tools to follow them. Review the whole package, not only its name or description.

What does prompt injection mean in a skill?+

Untrusted skill content may try to redirect an agent away from the user's intended task, for example by asking it to ignore other instructions or disclose secrets. Static patterns can flag indicators, but they cannot establish how every model and session will react.

Does a package scan replace agent permissions or a pentest?+

No. Keep tool permissions narrow, review sensitive actions and test with disposable data. A package scan covers the supplied files; an application pentest examines the broader system, integrations and real authorization boundaries under an agreed scope.