Get the scan skill
Download lolskills-scan.zip and inspect SKILL.md and the scan helper. The archive also includes its license and notice. It requires Node.js 22 or newer; no API key is needed. The helper sends the public repository, commit, and skill path to LOLSkills; it does not upload local files.
Extract the lolskills-scan folder to the personal skills directory for your agent:
- Claude Code:
~/.claude/skills/lolskills-scan/ - Codex:
~/.agents/skills/lolskills-scan/
Reload your agent if the skill does not appear. See the official Claude Code and OpenAI skills guides for discovery and installation details.
Use the shared public allowance
The helper uses the keyless public API. Website and API visitors share 100 scans per 24-hour allowance window, including up to 10 AI scans. Each IP has five submission attempts per ten minutes. A limit response pauses the workflow; do not automatically resubmit.
No key or account setup is needed. See the API guide for the request format and limits, or join the MagicSword community for integration help.
Check a skill
Ask your agent: “Use lolskills-scan to check this GitHub skill before installing it.” You can invoke it explicitly with /lolskills-scan in Claude Code or $lolskills-scan in Codex.
The agent resolves an exact commit and locates the selected SKILL.md, then runs the bundled helper. The scan can take several minutes. It never installs or executes the submitted skill.
- No findings: the requested scan finished with complete coverage. The agent can continue your authorized installation at the scanned commit and path.
- Findings detected: rule signals or correlated findings stop the install workflow. Signals alone do not establish maliciousness.
- Incomplete: coverage gaps, unavailable service, missing access, or a timeout pause the workflow. An incomplete scan cannot clear an install.
AI intent is off by default. Request it explicitly to add an advisory assessment; it never overrides deterministic signals or missing coverage. A completed assessment of likely malicious or uncertain pauses installation for review even without rule matches. Changes to the commit or local files require a new check.
What runs automatically?
The skill can be selected by your agent for install and update requests, and it performs submission, polling, and result checks automatically when invoked. It is guidance for the agent: it does not intercept every installer, watch directories, or block installations made outside that workflow.
For enforced protection, the next step is a controlled installer that stages the exact version, scans it, and only activates the verified files when all required checks finish without findings. A Claude Code PreToolUse hook can gate supported installation commands; its protection is limited to the tools it covers. A directory watcher runs after files change and cannot guarantee a check before loading.
ChatGPT support
A ChatGPT integration is planned. An MCP plugin can submit scans through the keyless endpoint and retrieve results, subject to the same service allowance and an additional limit for its shared server. This local Node.js helper is not a ChatGPT installation hook.
Read the scan methodology and privacy information. A completed scan is evidence about one version, not a guarantee of safety.