Skarn

개요

The skill runs two passes. skarn assess reads the session transcripts that AI coding assistants have already written to disk and reports leaked credentials, prompt injection, exfiltration attempts, and the chains that connect them; each finding carries the standards mappings that apply to it, drawn from MITRE ATLAS, the OWASP Top 10 for LLM Applications 2025, the OWASP Agentic Top 10, and CWE. skarn vet reads the assistant configuration files on the same machine and reports risky declarations: hooks, MCP servers, and permission grants that could run remote code or send data off the machine. Both passes run entirely on this machine and make no network call. Neither modifies a session transcript or a configuration file, and every credential value in the output is masked, so a finding names a rule and a masked preview and never the credential itself. Skarn surfaces findings and does not rotate a credential or edit a configuration on its own: the skill proposes, and the user decides. The one thing the skill can write is a baseline entry recording a finding the user has explicitly confirmed as a false positive. The skill runs a local shell command, so it is offered in Codex. It does not carry the skarn binary, which is installed separately: brew install skarn-security/tap/skarnnpm install -g @skarn-security/skarnRelease binaries: https://github.com/skarn-security/skarn-dist/releases/latest When the binary is not installed, the skill says how to install it and stops rather than inventing a result. skarn assess and skarn vet need no account and no license. Skarn also ships a hook that inspects a tool call before Codex runs it, and a skill that reconstructs recent work from session history. Both are distributed through the plugin marketplace at https://github.com/skarn-security/agent-guard. Documentation: https://getskarn.com/integrations/Support: hello@getskarn.com