One immutable snapshot

A submission resolves to an exact GitHub commit. The scanner downloads that revision and identifies SKILL.md files and their bundles. Paths, archive sizes, file counts, and extraction behavior are bounded. Submitted skills are inspected as data; their instructions and bundled programs are never intentionally executed.

Three layers of inspection

  1. Raw detections. Nova inspects instruction patterns and semantic signals. YARA checks the bundle against its configured rules. All retained matches are visible in the report.
  2. Behavioral correlation. The scanner checks file applicability and related signals. A sensitive source and a suspicious destination within a nearby code window are stronger evidence than a credential keyword alone.
  3. Optional intent assessment. An AI model receives bounded, redacted context around matches and considers declared purpose, consent, fixtures, and legitimate integrations. Its assessment remains advisory.

How to read an outcome

No findings detected
Required checks completed without matching a configured rule. This does not prove the skill is safe.
Signals detected
Raw matches exist, but none passed the correlation gate. Review the matches in the context of the skill’s purpose.
Needs review
Medium or high evidence passed the correlation gate. A human must assess whether that behavior is unauthorized or malicious.
Scan incomplete
A required check, source acquisition, or coverage requirement failed. Partial findings are retained where possible.

Known limits

This is static analysis. The initial correlation policy emphasizes nearby signals in the same file and a bounded set of suspicious destinations. It may miss indirect behavior across files, arbitrary attacker domains, obfuscated payloads, fetched dependencies, or actions that occur only at runtime. Results apply to the recorded commit and configuration; later changes require another scan.

Semantic similarity, rule severity, match count, and model confidence are not measured accuracy. Even a strong candidate is provisional. This website does not automatically label submissions “confirmed malicious.”

Built on open-source detection

Crucible brings together the NOVA Framework for prompt-pattern inspection and YARA-based bundle checks. We also thank YARA Forge and its contributors for their work on standardized, quality-checked YARA rule collections. These projects and the wider rule-author community deserve the credit for their work.

MagicSword provides this interface, orchestration, and report presentation. The upstream projects do not endorse individual reports, and their names are not a guarantee of safety.

Transparent examples

The example reports contain fictional data to demonstrate these distinctions. They are not reports of observed attacks.