Oktsec Signal

Security signal for the AI-agent ecosystem.

Agents inherit risk from the software they load and call. Signal scans full repositories, not just instruction files, so teams can review MCP code, scripts, workflows, packages and install logic before trust.

A reproducible map of the software agents load and call.

signal · AI-agent repos, sort: risklive
Facme/agent-packinstall.py supply-chain
Dcontrib/mcp-toolsMCP tool poisoning
Corg/deploy-cliscripts/run.sh command exec
Blab/ai-actions.github/workflows risk
Aorg/clean-repoclean

whole-repo grades, reproducible by pinned engine version

The new dependency surface

Agents inherit risk from the software they load and call.

AI agents rely on external components to act: MCP servers, tools, packages, CLIs, workflows, skills and repository templates. Each can expand what the agent can access, execute or expose.

Tool exposure

MCP servers and tools define what an agent can call, and on whose behalf.

Execution paths

CLIs, scripts and workflow actions turn agent intent into system changes.

Supply-chain risk

Packages and templates introduce behavior nobody reviewed.

Trust decisions

Teams need to review components before they enter agent work.

What Signal maps

A map of the components agents depend on.

We clone each repository and scan every file, so Signal already surfaces risk across the surfaces a repo ships, not just its skill instructions. Skills are where the public directory starts; the detection spans the whole repo.

Agent skills The skill instructions an agent is told to follow. covered today
AI-agent repositories The whole repo, graded A-F across every file. covered today
MCP server code Tool definitions and handlers an agent can call. detected · directory next
CLIs & scripts Command surfaces and shell that execute on the host. detected · directory planned
Packages (package.json, lockfiles) Declared and transitive dependencies pulled at install. detected · directory planned
GitHub Actions (.github/workflows) Workflow permissions, secrets handling and pipeline trust. detected · directory planned
Supply-chain install logic Download-and-execute and post-install behavior. detected today

Detection coverage is already ecosystem-wide because we scan the whole repository. What is "next" is browsing each surface as its own first-class list, not the detection itself.

What Signal detects

Deterministic detections teams can review.

Signal uses deterministic rules to surface patterns worth reviewing. A detection is not a claim that a component is malicious; it is a signal it deserves security attention before trust.

Detections, not verdicts. Signal surfaces patterns to review; it does not declare a component safe or unsafe by itself.
Detection categories
Prompt injection Credential exposure Download-and-execute Suspicious command execution SSRF & cloud metadata access MCP tool poisoning Supply-chain installation risk Data exfiltration
How it works

From a repository to a reproducible grade.

Signal scans every indexed repository deterministically, with GitHub code search as the only crawl source. No registry scrapers, no sampling.

01

Discover

GitHub code search finds AI-agent repos. The seed today is filename:SKILL.md, with more seeds next.

02

Clone

Pull the whole repository, with content-hash dedup so unchanged repos are skipped.

03

Scan every file

Oktsec's deterministic engine runs offline across all 12 analyzers: skills, MCP code, CLIs, packages, Actions and supply-chain. A pinned version yields identical results.

04

Publish

Audit low-confidence matches, grade A-F per repo, and export the directory, datasets, badges and alerts.

Whole repo.Deterministic.Reproducible.
The evidence

They audit the skill file. We audit the repository it ships in.

Skill-only scanners read the SKILL.md. The real risk lives in the rest of the repository, the install scripts, dependencies, workflows and MCP code. Signal scans all of it, deterministically and reproducibly, so it surfaces what they never open.

Surface scanned
Oktsec Signal
whole repo · reproducible
Snyk agent-scan
skill file
Socket / Gen
packages / skill text
Skill instructions SKILL.md
MCP server code tool definitions & handlers
CLIs & scripts command surfaces, shell
Packages & lockfiles declared & transitive deps
GitHub Actions .github/workflows
Supply-chain install logic build.rs, setup.py, lifecycle partial
11%
Measured · 80 repos

of audited repos carried HIGH/CRITICAL risk in code the others never open: scripts, workflows and MCP server code, including cases all three providers (Snyk, Socket, Gen) missed entirely. On 80 skills audited by skills.sh.

RepositoryRisk Signal found (outside the SKILL.md)Snyk · Socket · Gen
jimliu/baoyu-skillscommand execution in scripts/check-paste-permissions.tsall clean - missed
starchild-ai-agent/official-skillsMCP server code in twelvedata/__init__.pyall clean - missed
schpet/linear-clisupply-chain in .github/workflows/release.ymlall clean - missed
onmax/nuxt-skillscommand execution in scripts/generate-components.tsall clean - missed
vercel-labs/skillsOIDC risk in .github/workflows/publish.ymlSnyk flagged a soft skill issue, missed the workflow

Verdicts from skills.sh's own published Snyk, Socket and Gen results. On the lone SKILL.md the tools mostly agree; the difference shows up across the rest of the repository, which only Signal scans. Every row is reproducible from a pinned engine version. Methodology, engine version and source list are published with the research.

Skill-only scanners audit the SKILL.md. Oktsec Signal scans the whole repository the skill ships in, so it surfaces the supply-chain, workflow and code risk they never look at.

The wedge

Reproducible by design.

Other scanners give you a different answer each run. Oktsec's engine doesn't: pin the version and the same component scores the same grade, forever. That is what makes it usable in CI and defensible in compliance.

Every Signal report shows the exact engine version that produced it, so any grade can be reproduced from scratch.

reproduce · pinned enginedeterministic
1scan ./repo --engine 0.24
2→ grade B · 1 low · hash 9c1f…a7
3scan ./repo --engine 0.27
4→ grade B · 1 low · hash 9c1f…a7
5identical · 0.24 ≡ 0.27
Free, public layer

Start in the open.

Signal starts as a public security index and a private monitoring layer for teams adopting AI agents.

01

Directory

Browse AI-agent repos by latest, risk, stars or forks.

02

Per-component report

Grade, detections and per-file findings for any repository.

03

In-browser scanner Planned

A local, in-tab scan of a component, with nothing sent to a server.

04

Badges, data & feed

Embeddable grade badges, bulk CSV datasets and a public RSS alert feed.

Private monitoring

From public signal to private monitoring.

The public index is step one. Signal can become private monitoring for the components a company depends on.

Planned for teams

Programmatic API

Keyed, rate-tiered endpoints: per-component report, search and rollups.

Planned for teams

Watchlists + webhooks

Track repos, owners and orgs; get a push when a new critical lands or a grade drops.

Planned for teams

CI gate

Fail a PR on a configurable grade or severity threshold before a component ships.

Planned for teams

Private / org scan

Scan an org's private repos with a scoped token; results stay private to the org.

Planned for teams

Historical timelines

Every grade over time, not just the last snapshot, to detect rug-pulls and drift.

Planned for teams

Author & network monitoring

Authors as first-class entities, with correlation to surface coordinated networks.

Get started

Put the AI-agent ecosystem under watch.

Browse the public index, or request private monitoring for the components your company depends on.