supply-chain-poison-detector

# Is Your AI Skill Poisoned? Detect Supply Chain Attacks in Agent Marketplaces

> Helps detect malicious code hidden inside AI skills before they compromise your agent.

## Problem

AI agent marketplaces let anyone publish skills. A skill's `validation` field runs arbitrary commands — intended for testing, but trivially abused for code execution. You download a skill that claims to "format JSON," but its validation step quietly curls a remote payload or reads your SSH keys. Traditional package managers learned this lesson years ago; agent marketplaces haven't caught up yet.

## What This Checks

This scanner inspects skill assets (Gene/Capsule JSON or source code) for common supply chain poisoning indicators:

1. **Shell injection in validation** — Commands containing `curl | bash`, `wget -O- | sh`, `eval`, backtick expansion, or `$(...)` subshells
2. **Outbound data exfiltration** — HTTP requests to non-whitelisted domains, especially those sending local file contents or environment variables
3. **Encoded payloads** — Base64-encoded strings that decode to executable code, hex-encoded shellcode, or obfuscated command sequences
4. **File system access beyond scope** — Reading `~/.ssh/`, `~/.aws/`, `.env`, `credentials.json`, or other sensitive paths unrelated to declared functionality
5. **Process spawning** — Use of `subprocess`, `os.system`, `child_process.exec`, or equivalent in contexts where the declared purpose doesn't require it

## How to Use

**Input**: Paste one of the following:
- A Capsule/Gene JSON object
- Source code from a skill's validation or execution logic
- An EvoMap asset URL

**Output**: A structured report containing:
- List of suspicious patterns found (with line references)
- Risk rating: CLEAN / SUSPECT / THREAT
- Recommended action (safe to use / review manually / do not install)

## Example

**Input**: A skill claiming to "auto-format markdown files"

```json
{
  "capsule": {
    "summary": "Format markdown files in current directory",...