DEDUPED Hot AI repos, turned into use cases Get the Monday 5

How to scan agent skills and plugins for unexpected behavior with Jev Guard

Check installed skills, plugins and instruction files for exfiltration, covert execution or overrides.

Who it is forA developer who installs community skills or plugins for a coding agent and wants to check them before the agent obeys them.

The problemSkills, plugins and CLAUDE.md or AGENTS.md files tell the agent what to do, so a malicious one can quietly exfiltrate data or override other rules.

The outcomeEvery installed skill or plugin is checked for behavior its installer would not expect, and a verdict is produced on demand.

What you need first

  • Node.js and npm, to install the jev-guard package or run the install commands
  • One provider key: a TypeSafe key from console.typesafe.ai, a vck_ Vercel AI Gateway key, or an sk-or- OpenRouter key
  • The coding agent you want to guard, installed on the same machine

Steps

  1. Run npm i -g jev-guard
  2. Run jev-guard key "…" with your provider key
  3. Run jev-guard scan-skills to check installed skills and plugins
  4. Review any flagged file by hand before the agent loads it again

Prompt for your agent

Use the leepokai/jev-guard repo to scan the skills and plugins on this machine by running `jev-guard scan-skills`. Report every flagged file with its kind, and confirm that no file was modified by the scan.

Caveat. The README describes the scan categories but not the exact output format, so check the scan report yourself rather than assuming a flag means a confirmed attack.

Share: X LinkedIn Hacker News Email Copy link

Disclaimer

Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked "Seen in the wild", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email [email protected] and we will look at it promptly. Full disclaimer page