superagent_

// security workers

Extensions and packages

[ view markdown ]

Check agent skills, MCP repositories, and registry packages before installation.

Agent skills

Score a GitHub hosted agent skill before an agent installs it or follows its instructions. Superagent treats every skill file as untrusted data and never executes fetched code.

How scoring works

A skill scan accepts a skills.sh URL, a GitHub URL pointing to a skill directory, or an owner/repository/skill identifier. The scan runs in three tiers:

  1. Identity — GitHub owner and repository age, stars, contributors, license, and archive or fork status.
  2. Static analysis — bounded retrieval of SKILL.md, scripts, rules, and references followed by checks for secret access, remote execution, install hooks, shadow chaining, and excessive scope.
  3. Content review — deterministic instruction manipulation and exfiltration checks followed by semantic review of each bounded text chunk.

Every completed skill scan attempts Security-One triage, including scans that fail to fetch or analyze the skill. A valid safe result can skip semantic review only when the entire bounded skill capture is complete and no deterministic threats were found; risky, incomplete, unavailable, or invalid triage falls back to semantic review. Identity-only preliminary responses remain provisional, and deterministic findings are never cleared by triage.

The identifier is the lowercase SHA-256 digest of the canonical skill identity. The scanner resolves the current Git commit and never executes fetched code.

Limits

Your organization must install the Superagent Security GitHub App before scanning skills. Superagent uses short lived installation credentials and does not require a personal access token. Private skill repositories are not supported.

A scan reads at most 200 files, 512 KB per file, and 2 MB in total.

Threats

When details=true or the verdict is suspicious / dangerous, skill scans may emit skill_description_injection, skill_credential_parameter_extraction, skill_output_poisoning, skill_shadow_chaining_external_installation, skill_scope_violation, skill_hidden_encoded_instructions, skill_remote_execution, skill_secrets, skill_install_hooks, and skill_unscannable.

Use it

  • Dashboard: open Agents → Context, paste a skill target, and open the result for identity, behavior, and content scores.
  • REST API: POST /api/v1/context/skill to score a skill and GET /api/v1/context/skill/{identifier} to look up a previous result by SHA-256. See the Context Guardrails API.
  • MCP: scan_skill.

The target may be a skills.sh URL, owner/repository/skill, or a GitHub tree URL pointing to the skill directory.

curl "https://superagent.sh/api/v1/context/skill?mode=full&details=true" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  --data '{"target":"https://skills.sh/vercel-labs/skills/find-skills"}'

GET never starts a new scan.

MCP repositories

Score a public GitHub repository that contains an MCP server before an agent installs or connects to it. Superagent inspects repository contents only. It does not connect to a live MCP endpoint or execute the server.

How scoring works

An MCP scan accepts owner/repository or a repository URL in the form https://github.com/owner/repository with an optional .git suffix. The scan runs in three tiers:

  1. Identity — GitHub owner and repository age, stars, contributors, license, and archive or fork status.
  2. Static analysis — bounded retrieval of manifests, MCP configuration, tool definitions, schemas, source, scripts, and install hooks. The scanner checks for tool shadowing, credential harvesting, exfiltration, excessive scope, secrets, remote execution, and hidden instructions.
  3. Semantic analysis — reviews tool names, descriptions, schemas, instructions, and relevant source for description injection, instruction injection, output poisoning, schema abuse, and silent capability escalation.

Completed MCP scans attempt Security-One triage, including failed materialization. Only a valid safe result with complete bounded capture and no deterministic findings skips semantic analysis. Missing, invalid, risky, or incomplete triage uses the existing semantic fallback; deterministic blocks remain in force. Preliminary identity-only results do not use Security-One.

The identifier is the lowercase SHA-256 digest of the canonical owner/repository identity. Superagent resolves the current Git commit and treats every fetched file as untrusted data.

Limits

MCP scans are GitHub only and require the Superagent Security GitHub App. Only public repositories are supported.

A scan reads at most 200 files, 512 KB per file, and 2 MB in total. Materialization and scan failures fail closed, producing mcp_unscannable rather than a safe result.

Threats

When details=true or the verdict is suspicious / dangerous, MCP scans may emit mcp_tool_shadowing, mcp_description_injection, mcp_instruction_injection, mcp_schema_abuse, mcp_output_poisoning, mcp_silent_capability_escalation, mcp_credential_harvesting, mcp_exfiltration, mcp_excessive_scope, mcp_hidden_encoded_instructions, mcp_remote_execution, mcp_secrets, mcp_install_hooks, and mcp_unscannable.

Use it

  • Dashboard: open Agents → Context, paste a public GitHub MCP repository, and open the result for identity, behavior, and content scores.
  • REST API: POST /api/v1/context/mcp to score a repository and GET /api/v1/context/mcp/{identifier} to look up a previous result by SHA-256. See the Context Guardrails API.
  • MCP: scan_mcp.
curl "https://superagent.sh/api/v1/context/mcp?mode=full&details=true" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  --data '{"target":"modelcontextprotocol/servers"}'
curl "https://superagent.sh/api/v1/context/mcp/<sha256>?details=true" \
  -H "Authorization: Bearer sk_live_..."

GET never starts a new scan.

Registry packages

Score a registry package before an agent installs it. Superagent uses the same supply chain pipeline as pull request supply chain scanning and maps that intelligence into identity, behavior, and content scores.

How scoring works

A package scan accepts ecosystem:name@version, for example npm:lodash@4.17.21 or pypi:requests@2.32.3. The scan runs in three tiers:

  1. Identity — package age, weekly downloads, maintainers, quality, and maintenance signals from package intelligence.
  2. Behavior — install hooks, network access, and other package-scoped alerts.
  3. Content — the same LLM risk assessment used by supply chain scanning on pull requests, inverted into a 0–100 safety score.

Completed package scans attempt Security-One triage on bounded structured package intelligence, including provider failures. The managed supply-chain provider already completes its content assessment before triage, so Security-One never bypasses or overrides provider risk, findings, or fail-closed errors. Without a valid triage result the security_one tier is absent; preliminary identity-only results remain provisional.

The identifier is the lowercase SHA-256 digest of the canonical coordinate. Aliases pip (PyPI), gem (RubyGems), and actions (GitHub Actions) are accepted.

Supported ecosystems

Supported ecosystems are npm, PyPI, Go, RubyGems, and GitHub Actions. Scan failures fail closed, producing package_unscannable rather than a safe result.

Pull request dependency checks continue to use this pipeline automatically when a supported lockfile changes.

Threats

When details=true or the verdict is suspicious / dangerous, package scans may emit package_network_access, package_install_hooks, package_credential_access, and package_unscannable when package intelligence or the risk assessment reports those behaviors.

Use it

  • Dashboard: open Agents → Context, paste a package coordinate, and open the result for identity, behavior, and content scores.
  • REST API: POST /api/v1/context/package to score a coordinate and GET /api/v1/context/package/{identifier} to look up a previous result by SHA-256. See the Context Guardrails API.
  • MCP: scan_package.
curl "https://superagent.sh/api/v1/context/package?mode=full&details=true" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  --data '{"target":"npm:lodash@4.17.21"}'
curl "https://superagent.sh/api/v1/context/package/<sha256>?details=true" \
  -H "Authorization: Bearer sk_live_..."

GET never starts a new scan.

Next steps