Check a skill

Paste a GitHub or npm link. BUFONITE pins it to one commit, reads every file and grades it A, B, C or CLOSED, with the file and the line for every finding.

Works with github.com/owner/repo, a folder or file link inside one, owner/repo, npmjs.com links, npm:package@1.2.0 and npx package. Not sure what you’ll get? See an example report.

What a check does

  1. FetchPins the link to one commit or version and reads it in memory. It never runs it.—
  2. StaticHidden text, hijack attempts, code that runs itself, reads of keys and wallets, exfil hosts.C
  3. LLM reviewTwo models read it the way your agent will, and a small local model reads what they skip.C
  4. SandboxRuns it on a separate machine with fake keys behind a logging proxy.CLOSED