DEV Community
•
2026-08-12 05:18
Built an offline static scanner for AI agent skills (SKILL.md) to detect prompt injections and secret stealers before install
Hey everyone,
Lately, I’ve been looking into how engineering teams interact with agentic frameworks like CrewAI, AutoGen, and custom internal platforms. As teams scale, they rely heavily on "Skill Bundles"—packages containing a SKILL.md instruction file along with supporting Python, Shell, or JavaScript scripts.
While talking to platform leads and security engineers, a common problem kept coming...