Show HN: SkillTotal – scan packages before Claude Code installs them

Category: security

Tags: security-scanner, supply-chain, static-analysis, ai-agents, claude-code, mcp

Score: 7.5/10 (Innovation: 7, Technical: 7, Documentation: 9, Utility: 7)

SkillTotal is a zero-dependency static security scanner for npm/PyPI packages, MCP servers, agent skills, and repositories, designed to run locally before a coding agent installs code. It uses regex and AST matching (no LLM) to detect shell execution, credential access, network egress, install-time hooks, obfuscation, prompt injection, and suspicious data flows, with every finding citing file and line. Its most innovative aspect is the Claude Code plugin that intercepts install commands and blocks or prompts based on scan results, addressing a real emerging supply-chain gap in AI-agent workflows.

Target audience: backend developers, devops engineers, security engineers, AI-agent users

Repository: https://github.com/pezhik/skilltotal · Python · Apache-2.0 · 15 stars

View on Hacker News