SkillTotal – scan packages before Claude Code installs them
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
SkillTotal is an open-source (Apache-2.0), zero-dependency static scanner for npm and PyPI packages, MCP servers, agent skills and repositories. It checks for shell execution, sensitive-path access, network egress, install-time hooks, obfuscation and prompt-injection phrasing, with each finding citing a file and line.