{
 "schema_version": 1,
 "generated": "2026-10-23",
 "id": "leepokai-jev-guard--scan-skills-and-plugins-before-install",
 "repo": "leepokai/jev-guard",
 "repo_url": "https://github.com/leepokai/jev-guard",
 "repo_slug": "leepokai-jev-guard",
 "title": "Scan agent skills and plugins for unexpected behavior",
 "page_title": "How to scan agent skills and plugins for unexpected behavior with Jev Guard",
 "summary": "Check installed skills, plugins and instruction files for exfiltration, covert execution or overrides.",
 "who": "A developer who installs community skills or plugins for a coding agent and wants to check them before the agent obeys them.",
 "problem": "Skills, plugins and CLAUDE.md or AGENTS.md files tell the agent what to do, so a malicious one can quietly exfiltrate data or override other rules.",
 "outcome": "Every installed skill or plugin is checked for behavior its installer would not expect, and a verdict is produced on demand.",
 "steps": [
  "Run `npm i -g jev-guard`",
  "Run `jev-guard key \"…\"` with your provider key",
  "Run `jev-guard scan-skills` to check installed skills and plugins",
  "Review any flagged file by hand before the agent loads it again"
 ],
 "agent_prompt": "Use the leepokai/jev-guard repo to scan the skills and plugins on this machine by running `jev-guard scan-skills`. Report every flagged file with its kind, and confirm that no file was modified by the scan.",
 "agents": [
  "any"
 ],
 "difficulty": "Intermediate",
 "time": "15 minutes",
 "basis": "readme",
 "caveat": "The README describes the scan categories but not the exact output format, so check the scan report yourself rather than assuming a flag means a confirmed attack.",
 "category": "Security and science",
 "tags": [
  "Security and science"
 ],
 "lang": "javascript",
 "requirements": [
  "Node.js and npm, to install the jev-guard package or run the install commands",
  "One provider key: a TypeSafe key from console.typesafe.ai, a vck_ Vercel AI Gateway key, or an sk-or- OpenRouter key",
  "The coding agent you want to guard, installed on the same machine"
 ],
 "risk": "none",
 "seen_in_the_wild": false,
 "mentioned_publicly": false,
 "risks": [],
 "best": false,
 "score": 0.9,
 "evidence": [],
 "url": "https://dedupedai.com/use-cases/leepokai-jev-guard/scan-skills-and-plugins-before-install/",
 "md": "https://dedupedai.com/use-cases/leepokai-jev-guard/scan-skills-and-plugins-before-install/index.md",
 "disclaimer": "Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked \"Seen in the wild\", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email hello@dedupedai.com and we will look at it promptly.",
 "api": "https://dedupedai.com/api/v1/usecases/leepokai-jev-guard--scan-skills-and-plugins-before-install.json",
 "api_version": "v1"
}