> For clean Markdown of this page, append .md to its URL. For the complete documentation index, see https://www.superagent.sh/llms.txt.


Check agent skills, MCP repositories, and registry packages before installation.

# Extensions and packages

## Agent skills

Score a GitHub hosted agent skill before an agent installs it or follows its instructions. Superagent treats every skill file as untrusted data and never executes fetched code.

### How scoring works

A skill scan accepts a skills.sh URL, a GitHub URL pointing to a skill directory, or an `owner/repository/skill` identifier. The scan runs in three tiers:

1. **Identity** — GitHub owner and repository age, stars, contributors, license, and archive or fork status.
2. **Static analysis** — bounded retrieval of `SKILL.md`, scripts, rules, and references followed by checks for secret access, remote execution, install hooks, shadow chaining, and excessive scope.
3. **Content review** — deterministic instruction manipulation and exfiltration checks followed by semantic review of each bounded text chunk.

Every completed skill scan attempts Security-One triage, including scans that fail to fetch or analyze the skill. A valid safe result can skip semantic review only when the entire bounded skill capture is complete and no deterministic threats were found; risky, incomplete, unavailable, or invalid triage falls back to semantic review. Identity-only preliminary responses remain provisional, and deterministic findings are never cleared by triage.

The identifier is the lowercase SHA-256 digest of the canonical skill identity. The scanner resolves the current Git commit and never executes fetched code.

### Limits

Your organization must install the Superagent Security GitHub App before scanning skills. Superagent uses short lived installation credentials and does not require a personal access token. Private skill repositories are not supported.

A scan reads at most 200 files, 512 KB per file, and 2 MB in total.

### Threats

When `details=true` or the verdict is `suspicious` / `dangerous`, skill scans may emit `skill_description_injection`, `skill_credential_parameter_extraction`, `skill_output_poisoning`, `skill_shadow_chaining_external_installation`, `skill_scope_violation`, `skill_hidden_encoded_instructions`, `skill_remote_execution`, `skill_secrets`, `skill_install_hooks`, and `skill_unscannable`.

### Use it

- **Dashboard**: open **Agents → Context**, paste a skill target, and open the result for identity, behavior, and content scores.
- **REST API**: `POST /api/v1/context/skill` to score a skill and `GET /api/v1/context/skill/{identifier}` to look up a previous result by SHA-256. See the [Context Guardrails API](https://www.superagent.sh/docs/api/context-guardrails).
- **MCP**: `scan_skill`.

The `target` may be a skills.sh URL, `owner/repository/skill`, or a GitHub tree URL pointing to the skill directory.

```bash
curl "https://superagent.sh/api/v1/context/skill?mode=full&details=true" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  --data '{"target":"https://skills.sh/vercel-labs/skills/find-skills"}'
```

`GET` never starts a new scan.

## MCP repositories

Score a public GitHub repository that contains an MCP server before an agent installs or connects to it. Superagent inspects repository contents only. It does not connect to a live MCP endpoint or execute the server.

### How scoring works

An MCP scan accepts `owner/repository` or a repository URL in the form `https://github.com/owner/repository` with an optional `.git` suffix. The scan runs in three tiers:

1. **Identity** — GitHub owner and repository age, stars, contributors, license, and archive or fork status.
2. **Static analysis** — bounded retrieval of manifests, MCP configuration, tool definitions, schemas, source, scripts, and install hooks. The scanner checks for tool shadowing, credential harvesting, exfiltration, excessive scope, secrets, remote execution, and hidden instructions.
3. **Semantic analysis** — reviews tool names, descriptions, schemas, instructions, and relevant source for description injection, instruction injection, output poisoning, schema abuse, and silent capability escalation.

Completed MCP scans attempt Security-One triage, including failed materialization. Only a valid safe result with complete bounded capture and no deterministic findings skips semantic analysis. Missing, invalid, risky, or incomplete triage uses the existing semantic fallback; deterministic blocks remain in force. Preliminary identity-only results do not use Security-One.

The identifier is the lowercase SHA-256 digest of the canonical `owner/repository` identity. Superagent resolves the current Git commit and treats every fetched file as untrusted data.

### Limits

MCP scans are GitHub only and require the Superagent Security GitHub App. Only public repositories are supported.

A scan reads at most 200 files, 512 KB per file, and 2 MB in total. Materialization and scan failures fail closed, producing `mcp_unscannable` rather than a safe result.

### Threats

When `details=true` or the verdict is `suspicious` / `dangerous`, MCP scans may emit `mcp_tool_shadowing`, `mcp_description_injection`, `mcp_instruction_injection`, `mcp_schema_abuse`, `mcp_output_poisoning`, `mcp_silent_capability_escalation`, `mcp_credential_harvesting`, `mcp_exfiltration`, `mcp_excessive_scope`, `mcp_hidden_encoded_instructions`, `mcp_remote_execution`, `mcp_secrets`, `mcp_install_hooks`, and `mcp_unscannable`.

### Use it

- **Dashboard**: open **Agents → Context**, paste a public GitHub MCP repository, and open the result for identity, behavior, and content scores.
- **REST API**: `POST /api/v1/context/mcp` to score a repository and `GET /api/v1/context/mcp/{identifier}` to look up a previous result by SHA-256. See the [Context Guardrails API](https://www.superagent.sh/docs/api/context-guardrails).
- **MCP**: `scan_mcp`.

```bash
curl "https://superagent.sh/api/v1/context/mcp?mode=full&details=true" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  --data '{"target":"modelcontextprotocol/servers"}'
```

```bash
curl "https://superagent.sh/api/v1/context/mcp/<sha256>?details=true" \
  -H "Authorization: Bearer sk_live_..."
```

`GET` never starts a new scan.

## Registry packages

Score a registry package before an agent installs it. Superagent uses the same supply chain pipeline as [pull request supply chain scanning](https://www.superagent.sh/docs/security-workers/pr-security) and maps that intelligence into identity, behavior, and content scores.

### How scoring works

A package scan accepts `ecosystem:name@version`, for example `npm:lodash@4.17.21` or `pypi:requests@2.32.3`. The scan runs in three tiers:

1. **Identity** — package age, weekly downloads, maintainers, quality, and maintenance signals from package intelligence.
2. **Behavior** — install hooks, network access, and other package-scoped alerts.
3. **Content** — the same LLM risk assessment used by supply chain scanning on pull requests, inverted into a 0–100 safety score.

Completed package scans attempt Security-One triage on bounded structured package intelligence, including provider failures. The managed supply-chain provider already completes its content assessment before triage, so Security-One never bypasses or overrides provider risk, findings, or fail-closed errors. Without a valid triage result the `security_one` tier is absent; preliminary identity-only results remain provisional.

The identifier is the lowercase SHA-256 digest of the canonical coordinate. Aliases `pip` (PyPI), `gem` (RubyGems), and `actions` (GitHub Actions) are accepted.

### Supported ecosystems

Supported ecosystems are npm, PyPI, Go, RubyGems, and GitHub Actions. Scan failures fail closed, producing `package_unscannable` rather than a safe result.

Pull request dependency checks continue to use this pipeline automatically when a supported lockfile changes.

### Threats

When `details=true` or the verdict is `suspicious` / `dangerous`, package scans may emit `package_network_access`, `package_install_hooks`, `package_credential_access`, and `package_unscannable` when package intelligence or the risk assessment reports those behaviors.

### Use it

- **Dashboard**: open **Agents → Context**, paste a package coordinate, and open the result for identity, behavior, and content scores.
- **REST API**: `POST /api/v1/context/package` to score a coordinate and `GET /api/v1/context/package/{identifier}` to look up a previous result by SHA-256. See the [Context Guardrails API](https://www.superagent.sh/docs/api/context-guardrails).
- **MCP**: `scan_package`.

```bash
curl "https://superagent.sh/api/v1/context/package?mode=full&details=true" \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  --data '{"target":"npm:lodash@4.17.21"}'
```

```bash
curl "https://superagent.sh/api/v1/context/package/<sha256>?details=true" \
  -H "Authorization: Bearer sk_live_..."
```

`GET` never starts a new scan.

## Next steps

- [Understand supply chain scanning](https://www.superagent.sh/docs/security-workers/pr-security/supply-chain-scanning)
- [Red-team a package](https://www.superagent.sh/docs/security-workers/red-team/packages)
- [Return to Context Guardrails](https://www.superagent.sh/docs/security-workers/agent-guardrails/context)

---
Source: https://www.superagent.sh/docs/security-workers/agent-guardrails/extensions-and-packages
Index: https://www.superagent.sh/llms.txt