Practical controls for local scans, CI checks, and production workflows, with clear evidence your team can review.
One control plane from static scan to runtime enforcement, built for agent security teams.
Block risky tool actions before they run across editor, local, and CI workflows.
Keep protections reliable with secure sessions and safe fallback behavior.
Protect MCP tool paths before requests reach external providers.
Protect Claude workspaces from unsafe configuration and prompt injection.
Run Codex safely with policy checks and strict CI defaults.
Generate records your security and compliance teams can trust.
Each protection layer has a dedicated guide so teams can deploy it in local development and CI.
Interception and policy checks before shell, network, and filesystem actions.
Guard OpenClaw and other local AI agents through skillgate run.
Config safety checks, provider trust controls, and CI hardening.
Instruction, hooks, plugins, and settings safety controls.
Trusted provider allowlists, metadata safety, and permission drift checks.
Signed session records and SARIF output for CI and audit.
Every rule has an ID, severity, weight, and clear description. No hidden scoring.
subprocess, system(), exec, backticks, popen
HTTP clients, raw sockets, server listeners
File writes, deletions, path traversal
eval, exec, unsafe blocks, dynamic loading
ENV access, hardcoded keys, secrets
SQL injection, template injection, format strings
Base64 encoding, hex encoding, char codes
Start with runtime protections locally, then enforce the same guardrails for MCP and Codex in CI.
Built on regression testbeds that replay capability patterns from large public agent skill collections.
# Install
pip install skillgate
# Scan a skill
skillgate scan ./my-skill --enforce
# Verify a signed report
skillgate verify report.json