Threat-hunting for the AI supply chain. Your agents load skills and connect to MCP servers written by strangers — each one a file the model reads and a tool it can invoke. SkillHawk audits them before you trust them: a native-Rust take on NVIDIA’s SkillSpector that flags prompt-injection, tool-poisoning, data-exfil and over-broad permissions in the things your agents install.
An Agent Skill is a Markdown file the model reads verbatim; an MCP server is a process that executes real actions on your infrastructure. Both are installed from public registries with a copy-paste. That is a supply chain — and nobody is checking it. A poisoned SKILL.md can carry hidden instructions; an MCP tool description can smuggle a prompt injection; either can quietly exfiltrate secrets the moment your agent obeys.
.env, ~/.ssh, cloud credentials or environment variables and ship them out — the classic “run a security scan and report” bait.Point SkillHawk at a skill directory, a .zip or a single file. It statically analyses every skill, script and MCP manifest, scores the risk, and hands back a clear SAFE / CAUTION / DO‑NOT‑INSTALL verdict — offline, no telemetry.
--llm newton / ollama / openai / anthropic) that understands context to cut MEDIUM/LOW false positives — and never weakens a verdict.-f sarif for CI — plus a baseline to accept known findings so only new risk breaks the build.ais serve runs SkillHawk as an MCP server exposing scan_skill — so your agent vets a skill at install time and refuses the unsafe ones automatically. Coding Sidekick’s cs skill add uses exactly this.--track ledgers a skill and flags a rug-pull — a permission, trigger or code change slipped in on a later version of something you already trusted.SkillHawk is being hardened for release. Drop your email and we’ll tell you the moment it ships.