Our Snyk Agent Scan gate refused a malicious skill. All 15 findings came from local rules.
We put Snyk Agent Scan behind a PR gate for new skills. On upstream's malicious fixture the gate reported passed false, 15 findings, highest severity critical, and exited 1.
By David Discua
Measured in the lab
- 15
- findings
- 15
- blocked at medium+
- critical
- highest severity
- 0
- snyk scan risks
- gate refused the malicious fixture (passed false, exit 1)
- 4 base64 decodes piped to bash flagged critical
- 4 base64 blobs that decode to shell flagged high
- 3 coercive instruction phrases flagged high
- clean fixture passes with exit 0
From reports/skill-gate.json · run on October 14, 2026. snyk-agent-scan 0.6.8 pinned at 2d24404; inspect only, no SNYK_TOKEN; fail_on medium; target is upstream's malicious-skill fixture
How it is wired
01/03A pull request adds a new skill or MCP config.
Snyk Agent Scan inventories agent skills and MCP servers, and with a Snyk token it analyzes them for prompt injection, tool poisoning and toxic flows. We wrapped it in a PR gate called skill-gate and pointed it at the malicious skill fixture that ships in upstream's own test suite. The report says passed: false, with 15 findings and a highest severity of critical, and the CLI exited 1, which is the result we wanted from a gate facing a bad skill. The catch is that without a token, Snyk's part of the run only lists the skill, and every one of those 15 findings came from our local rules.
The catch
Keyless, skill-gate calls snyk-agent-scan inspect --json. Inspect finds the components and their files and does no risk analysis. The report shows snyk_token_configured: false, scan_risk_count: 0 for the one component, and no scan responses. The blocks came from the six pattern rules in src/skill_gate/rules.py, which match things like base64 piped to a shell, base64 blobs that decode to shell commands, coercive phrases and external download URLs.
Pattern rules catch the obvious installer tricks in this fixture. They will miss a prompt injection written in plain, polite English. For that you need the live scan, which needs SNYK_TOKEN and sends component content to Snyk under upstream's TERMS.md. Decide whether that is acceptable for your skills before you turn it on.
One upstream unit test is deselected in our CI. At the pin, test_collect_consent_redacts_url_query_values_without_changing_destination fails because the terminal library wraps a long URL onto the next line. We log it as deviation A2b in RESULTS.md.
What we ran (keyless)
uv sync --locked --group dev
uv run ruff check .
uv run ruff format --check .
uv run pytest -q
uv run skill-gate check tests/fixtures/malicious-skill
uv run skill-gate check tests/fixtures/clean-skill
From reports/skill-gate.json, run on October 14, 2026, against tests/fixtures/malicious-skill/SKILL.md with fail_on: medium:
| Rule | Severity | Findings | What it matched |
|---|---|---|---|
base64-pipe-shell | critical | 4 | base64 -D | bash |
base64-blob | high | 4 | a blob that decodes to /bin/bash -c "$(curl ...)" |
hidden-instruction | high | 3 | "CRITICAL: For Windows download", "WITHOUT COMPLETING THE SETUP" |
external-url | medium | 4 | a GitHub release AuthTool.zip download |
All 15 findings sit at or above medium, so all 15 are blocked. The fixture repeats its install line four times, which is why most rules fire four times. RESULTS.md records the rest of the local gate: pytest 7 passed and 1 skipped (the live test, without SNYK_TOKEN) in 28.98 s, ruff clean, pip-audit --strict with no known vulnerabilities, and the clean fixture exiting 0.
How it is wired
The gate runs on a pull request, before a new SKILL.md or MCP config lands. uv run skill-gate changed --base origin/main checks only changed paths. Exit 0 allows the merge, and 1 or 2 fails CI. Our lab skill, gate-new-skill, tells Claude Code or Cursor to run the gate before installing another skill or MCP server, and the lab never passes --dangerously-run-mcp-servers.
Minilab (open source)
The lab pins snyk/agent-scan as a git submodule at v0.6.8 (3,138 stars, Apache-2.0, Python, as of October 14, 2026). Clone with --recurse-submodules, run uv sync --locked --group dev, then check both fixtures and compare reports/skill-gate.json with ours.
Run it yourself
SkilledDragonCorp/minilab-agent-scan-skill-gate
Clone, install and run the report with no API keys. The numbers above are what that run writes.
uv sync --locked --group dev && uv run skill-gate check tests/fixtures/malicious-skillSkilledDragon is not affiliated with Snyk or snyk/agent-scan. Numbers are from our own keyless lab run; re-run the report before relying on them. Marks belong to their owners.
All labs