SKILL 감독을 위한 LLM 시약 근거한 스캐너. Vetix 쌍은 LLM 행동 분석가를 가진 결정적인 플러그인 규칙을 세웁니다 그래서 타협과 미묘한의 명백한 지시자, obfuscated 공격 사슬은 단 하나 통행에서 붙잡습니다.

English한국어

[!수신] examples/ 디렉토리는 deliberately Crafted malicious sample을 포함한 테스트 목적으로 샘플 SKILL을 포함합니다. 스캔 테스트 환경에서 SKILL을 설치하거나로드하지 마십시오.

특징

• **Plugin 기반 정적 스캐닝 ** - 규칙은 결정적인 보안 위험을 잡습니다. -LLM cross-validation — 모든 플러그인 히트는 LLM에 의해 실제 파일 내용에 대한 재 판단, 그래서 높은 호출 규칙은 최종 보고서를 무시하지 않습니다. -Behavioral analysis agent — read-only virtual filesystem 내부는 완전한 chain "instruction → tool call → host impact"를 추적하여 규칙을 놓치지 않도록 합니다. disguised commands, Base64 payloads, remote code loading, prompt injection, credential theft, persistence 등이 있습니다.
• Defense-in-depth sandbox - 에이전트는 기술 내에서만 읽습니다. symlinks는 거부되며, 모든 글은 백엔드에서 거부되며, mutating 도구는 모델에서 숨겨집니다.

Vetix

An LLM-agent-based scanner for SKILL directories. Vetix pairs deterministic plugin rules with an LLM behavioral analyst so that both obvious indicators of compromise and subtle, obfuscated attack chains get caught in a single pass.

中文文档

[!WARNING] The examples/ directory contains sample SKILLs for testing purposes, including deliberately crafted malicious samples. Do not install or load these SKILLs outside of a scanning test environment.

Features

• Plugin-based static scanning — rules catch deterministic security risks.
• LLM cross-validation — every plugin hit is re-judged against the real file content by an LLM, so high-recall rules don’t drown the final report.
• Behavioral analysis agent — inside a read-only virtual filesystem, traces the full chain “instruction → tool call → host impact” to uncover risks the rules miss: disguised commands, Base64 payloads, remote code loading, prompt injection, credential theft, persistence, and more.
• Defense-in-depth sandbox — the agent reads only inside the skill, symlinks are refused, every write is rejected at the backend, and mutating tools are hidden from the model.
• Token usage accounting — the report records the token usage of every model call in a scan (prompt / completion / total + call count), so batch scan costs can be estimated.
• LangSmith tracing — every agent run is observable end-to-end.

CLI Options

Usage:
  vetix -s  | -p  [flags]

Flags:
  INPUT
    -s, -source string   SKILL directory path or a skills parent directory
    -p, -preset string   Scan all skills under a preset agent skills root (claude-code, codex)

  CONFIG
    -c, -config string   Path to the YAML config file (default "./config.yaml")
    -l, -language string Output language for audit findings (en, zh) (default "en")

  OUTPUT
    -o, -output          Save the audit report to //report.json (default true)
    -no-output           Disable saving the audit report to a JSON file
    -output-dir string   Base directory for saved reports (default "./output")
    -force               Ignore the cached report and force a full re-scan

  DEBUG
    -d, -debug           Enable debug logging

  PLUGIN
    -pl, -plugins-list   List built-in plugins with their names and descriptions

Common commands

# Scan a single SKILL; requires a SKILL.md file in the directory
vetix -s ./examples/malicious/wacli-1sk

# Scan the entire SKILL directory; requires a SKILL.md file in the immediate subdirectories
vetix -s ~/.claude/skills

# Scan using the preset path
vetix -p claude-code

# View the list of plugins
vetix -pl

Report Caching