Skill files can hide instructions that hijack your agent, move your data, or harvest credentials. Canary screens them before trust becomes execution.
Try the early warning
The demo checks locally for instruction overrides, hidden persistence, credential access, exfiltration, obfuscation, and related attack signals.
Demo runs a subset of Canary's deterministic checks in your browser. The downloadable kit includes all deterministic checks and instructions for running a separate isolated classifier. The CLI itself runs the deterministic layer only.
Defense in depth
A pattern engine catches known-bad mechanics. A contained model catches meaning that rigid patterns miss. Neither gets the only vote.
Static checks inspect text without executing it or obeying it. The scanner cannot be persuaded by the skill it is judging.
A fresh, tool-less session evaluates intent under a fixed output contract. Even if the skill manipulates it, there is nowhere for data to go.
Field report · 2026-09-26
We ran Canary's deterministic layer across 100 public skills: 20 official Anthropic, 15 obra/superpowers, and 65 wshobson/agents.
All 15 unsafe scores were driven by documentation-URL volume—not live threats. The most-flagged skill was Anthropic's own official claude-api skill (score 236), almost entirely from documentation links. That is calibration evidence, not a breach report.
The read: this sample produced no findings in those eight categories. That does not establish that these skills—or the wider supply chain—are safe. Canary pairs deterministic checks with a separate isolated classifier workflow to support human review.
One-shot setup
The kit is a small Python scanner plus the isolated-classifier workflow. No package dependencies. Keep it next to the agent that installs your skills.
“Set up Canary from this page, scan my existing skills, quarantine anything flagged, and tell me the verdict counts.”
Simple pricing
Generous by design. Scan the skills you use, inspect every finding, and keep the gate in front of your agent.
A flat team subscription with personal setup help, GitHub pull-request scan gates, and locally held policy and scan records. We help you provision your team after purchase.
Explore Team early access →A manually reviewed, publicly verifiable record for a specific skill version. Publisher verification and both scan layers are required; payment does not guarantee approval.
See the badge review process →