This product was not featured by Product Hunt yet. It will not be visible on their landing page and won't be ranked (cannot win product of the day regardless of upvotes).
We built a zero-config npm/pip scanner that audits AI agent skills before installation. We expose security gaps by diffing declared permissions against real-world behavior across 10 rule categories. Unlike single-file scanners, we catch combined multi-file risks: privilege chaining, prompt injections, undeclared network calls, and credential harvesting. SkillGuard is open-source, self-hosted, and licensed with Apache 2.0.
As AI agents become more autonomous, incorporating third-party skills via npm or pip introduces significant security blind spots. We noticed that traditional, single-file scanners struggle to detect complex, multi-file vulnerabilities. Security teams need a reliable way to audit what an AI skill actually does at runtime versus what it claims to do.
We wanted to expose these security gaps before a package is ever installed. The inspiration came from seeing how easily malicious actions such as credential harvesting, undeclared network calls, cross-skill privilege chaining, or hidden prompt injections could bypass standard checks by spreading across hooks, scripts, and SKILL.md files.
What started as a concept for basic permission diffing evolved into a rigorous behavioral auditing tool. We realized that to be truly effective for fast-moving development teams, the tool needed to be completely frictionless. That realization drove us to build a zero-config, self-hosted solution that validates actual code behavior across 10 comprehensive rule categories. We also ensured it could be seamlessly deployed anywhere: via CLI, library, MCP server, or GitHub Action, without any authentication requirement.
No comment highlights available yet. Please check back later!
About SkillGuard on Product Hunt
“Scans AI agent skills for malicious code”
SkillGuard was submitted on Product Hunt and earned 2 upvotes and 1 comments, placing #157 on the daily leaderboard. We built a zero-config npm/pip scanner that audits AI agent skills before installation. We expose security gaps by diffing declared permissions against real-world behavior across 10 rule categories. Unlike single-file scanners, we catch combined multi-file risks: privilege chaining, prompt injections, undeclared network calls, and credential harvesting. SkillGuard is open-source, self-hosted, and licensed with Apache 2.0.
SkillGuard was featured in Open Source (68.8k followers), Developer Tools (518.4k followers), Artificial Intelligence (477.4k followers) and GitHub (41.4k followers) on Product Hunt. Together, these topics include over 242k products, making this a competitive space to launch in.
Who hunted SkillGuard?
SkillGuard was hunted by Sourav Nandy. A “hunter” on Product Hunt is the community member who submits a product to the platform — uploading the images, the link, and tagging the makers behind it. Hunters typically write the first comment explaining why a product is worth attention, and their followers are notified the moment they post. Around 79% of featured launches on Product Hunt are self-hunted by their makers, but a well-known hunter still acts as a signal of quality to the rest of the community. See the full all-time top hunters leaderboard to discover who is shaping the Product Hunt ecosystem.
Want to see how SkillGuard stacked up against nearby launches in real time? Check out the live launch dashboard for upvote speed charts, proximity comparisons, and more analytics.
Sourav Nandy
As AI agents become more autonomous, incorporating third-party skills via npm or pip introduces significant security blind spots. We noticed that traditional, single-file scanners struggle to detect complex, multi-file vulnerabilities. Security teams need a reliable way to audit what an AI skill actually does at runtime versus what it claims to do.
We wanted to expose these security gaps before a package is ever installed. The inspiration came from seeing how easily malicious actions such as credential harvesting, undeclared network calls, cross-skill privilege chaining, or hidden prompt injections could bypass standard checks by spreading across hooks, scripts, and SKILL.md files.
What started as a concept for basic permission diffing evolved into a rigorous behavioral auditing tool. We realized that to be truly effective for fast-moving development teams, the tool needed to be completely frictionless. That realization drove us to build a zero-config, self-hosted solution that validates actual code behavior across 10 comprehensive rule categories. We also ensured it could be seamlessly deployed anywhere: via CLI, library, MCP server, or GitHub Action, without any authentication requirement.
Repo:
https://github.com/RudrenduPaul/skillguard
MCP Servers:
https://mcpservers.org/servers/rudrendupaul/skillguard
https://glama.ai/mcp/servers/RudrenduPaul/skillguard
NPM:
https://www.npmjs.com/package/skillguard-cli
PyPI:
https://pypi.org/project/skillguard-cli
We have open-sourced the project under Apache 2.0 and would love your feedback on the rule categories and threat detection capabilities.