One immutable snapshot
A submission resolves to an exact GitHub commit. The scanner downloads that revision and identifies SKILL.md files and their bundles. Paths, archive sizes, file counts, and extraction behavior are bounded. Submitted skills are inspected as data; their instructions and bundled programs are never intentionally executed.
Layers of inspection
- Raw detections. NOVA inspects instruction patterns and semantic signals. YARA checks the bundle against its configured rules. All retained matches are visible in the report.
- Behavioral correlation. LOLSkills checks file applicability and related signals. A sensitive source and a suspicious destination within a nearby code window are stronger evidence than a credential keyword alone.
- Artifact inspection. Compatible scanner versions inspect bounded nested archives, decoded literals and executable download references with ClamAV, LIEF, capa and static script checks alongside NOVA/YARA. Reports show acquired hashes, parent files and analyzer gaps. A parsed binary or zero antivirus detections does not establish safety.
- Optional intent assessment. When requested, an AI model reviews bounded, redacted skill context and considers declared purpose, consent, fixtures, and legitimate integrations, including skills with no rule hits. Its assessment remains advisory. Older scanner versions may have skipped this assessment when no rules matched.
How to read an outcome
- No findings detected
- Required checks completed without matching a configured rule. This does not prove the skill is safe.
- Signals detected
- Raw matches exist, but none passed the correlation gate. These matches can also occur in legitimate skills.
- Correlated findings
- Related signals passed the correlation gate. The report identifies the detected behavior and supporting evidence.
- Scan incomplete
- A required check, source acquisition, or coverage requirement failed. Partial findings are retained where possible.
Which scanner returned results?
Each skill report shows results by scanner: NOVA and YARA raw matches, the correlated findings each supports, available artifact analyzer results, and the optional AI assessment with its recorded model. A finding can have evidence from multiple engines, so their contributions should not be added together as independent findings.
Completion is shown only when the report records it. Historical reports can contain results without per-engine completion details. Truncated match lists show lower bounds or unavailable counts; a missing result is never evidence that an engine completed without findings. Scan details preserves the scanner image, engine versions, rules revision, and available coverage.
Known limits
This is static analysis. The initial correlation policy emphasizes nearby signals in the same file and a bounded set of suspicious destinations. It may miss indirect behavior across files, arbitrary attacker domains, obfuscated payloads, fetched dependencies, or actions that occur only at runtime. Results apply to the recorded commit and configuration; later changes require another scan.
Semantic similarity, rule severity, match count, and model confidence are not measured accuracy. This website does not automatically label submissions “confirmed malicious.”
Credits & references
Explore the detection projects, community contributions, and scanner research on our credits & references page.
Transparent examples
The example reports contain fictional data to demonstrate these distinctions. They are not reports of observed attacks.