SkillTotal

SkillTotal is a static security scanner for npm and PyPI packages, MCP servers, agent skills and repositories.

SkillTotal is a static security scanner designed to check npm and PyPI packages, Model Context Protocol servers, agent skills, and repositories before coding agents install or run them. It uses regex and abstract syntax tree matching without relying on large language models, ensuring deterministic results with every finding citing a specific file and line. The engine fetches component archives or clones, reads files, correlates findings like credential reads and network egress into exfiltration paths, and scores risks from zero to 100. It is built for developers and teams using AI coding assistants who need to prevent malicious installations and supply chain threats. The tool runs locally with zero runtime dependencies beyond the Python standard library and is available as a command-line interface, Claude Code plugin, GitHub Action, and MCP server under an open-source Apache-2.0 license.

SkillTotal at a glance

Best for: Software engineer
Runs on: Web, CLI, GitHub Action, self-hosted, open source
Pricing: Free, forever (Open source)
Released: October 2026
Category: AI coding tool
Website: github.com/pezhik/skilltotal

Key features

Scans npm and PyPI packages, repositories and local folders
Detects shell execution, filesystem access and network egress
Finds install-time execution, dynamic code execution and obfuscation
Identifies MCP risks, prompt surface issues and hidden Unicode
Provides behavioral trait fingerprints and OWASP mappings
Runs locally with zero runtime dependencies
Integrates via CLI, GitHub Action and Claude Code plugin

Use it for

Check packages before coding agents install them
Gate pull requests in continuous integration pipelines
Analyze Model Context Protocol servers for risks
Audit npm and PyPI dependencies locally

Alternatives to SkillTotal

Cisco Skill Scanner — Combines pattern matching, dataflow analysis, and an optional LLM judge for threat detection.
AgentGuard — Get a security and quality assessment of AI skills in seconds without an account.
pstack — Improves AI coding agent outcomes with rigorous workflows.
Reverse Skill — Routes AI agents to exact security methodologies instead of guessing commands.
CodeScan Artex — It uses multiple parallel AI agents to read source code and verify vulnerabilities.
Skill Seekers — Converts 18 data sources into structured AI skills for 22 platforms.
Agent Skills — Encodes senior-engineer workflows and quality gates into 24 skills.
Skillhub Local — Consolidates scattered AI agent context and skills into one local dashboard.
ARTEX — Runs autonomous multi-agent penetration testing with a dual-graph architecture.
jevgrep — Reduces coding agent costs by providing targeted, relevant repository context.
Manifestack — Audits your entire tech stack and flags limits or vendor overlaps.
ShipOrNah — Checks AI-generated apps for exposed API keys and missing Supabase RLS.

All SkillTotal alternatives