Pre-install vetting for agent skills & MCP servers
Check it before your agent runs it.
Paste a link to a skill or MCP server. Preflight reads the code and the instructions, then shows you exactly what it touches, in plain English. Free.
Works with github.com repos, skills.sh listings, and direct .zip archives. For a ClawHub skill, scan its source repo or paste the SKILL.md — ClawHub's API does not serve package downloads.
No link? Paste a SKILL.md instead
How it works
We read, never run
The package is downloaded and read as inert text. Static analysis only. Scanned code is never executed, imported, or installed.
Every claim has a receipt
Each finding names the file, the line, and the exact text that triggered it. Credential access, exfiltration shapes, shell execution, prompt injection, obfuscation. No vibes, no black-box score.
You get a grade
Clean, Caution, Risky, or Hostile, with the subscores behind it and a full permission summary: network, environment, shell, files. Share the report link with anyone.