wtf is skill-discovery?

Skill discovery is a small security tool built for people who use AI coding agents like Claude Code, Codex, Cursor, Copilot, Windsurf, Kiro, Antigravity, and opencode. These agents can be given skills, which are folders of standing instructions that shape what the agent does in every future session, along with separate instruction files such as rules or custom instructions. Over time these accumulate from repositories, marketplaces, and pasted snippets, and it becomes easy to lose track of exactly what is installed on your machine. The tool runs entirely on your own computer with a single command, no server or account required, and reports every skill and instruction file it can find. The author built it after realizing that with skills becoming cheap to create, there was no easy way to answer a basic question: what is actually installed on a given laptop. This matters because security researchers have documented real examples of malicious skill patterns being distributed, so simply assuming you know what is installed is no longer good enough. With no arguments, it automatically scans the known storage locations for each supported agent and also walks your home directory to find project level skills committed inside your own repositories. Output adapts to context: a readable summary at the terminal, or a JSON report when the output is piped elsewhere, so it can be combined with other command line tools. A dry run mode makes zero network calls, meaning nothing leaves your machine and you can see exactly what a report would contain first. For each skill found, the tool parses its name and description, computes a fingerprint that stays consistent across Windows, macOS, and Linux, and checks it against built in offline rules for known malicious patterns, such as hidden payloads or prompt injection attempts. It can also use an external scanner called NVIDIA SkillSpector if that is installed. It additionally flags secrets or personal information that would need to be redacted before any report is shared or uploaded elsewhere. Installing it requires Python 3.9 or newer and one dependency, PyYAML.