Commented on Spellwarden · Nov 9, 2026
Hi DevHunt, I'm Marius, the solo founder of Spellwarden. At my DevOps consultancy, teams started adding skills and MCP servers to their agents straight from a README, without reading them. A skill runs with your shell and your keys, so I built a scanner for exactly those files. Try it in a minute, no account: - pipx run spellwarden scan . in any repository with skills, Claude Code plugins, hooks or .mcp.json - the GitHub Action spellwarden-ai/scan or the GitLab component, with SARIF output - the live demo, a working organisation: https://dash.spellwarden.ai/live-demo The scanner is open source (Apache-2.0, 65 rules mapped to OWASP and NIST) and never runs the files it reads. The hosted plans add policy export to Claude Code hooks, Kong and Zuplo, paired evals, runtime traces and a private registry. What I'd most like from you: a false positive, a rule you'd expect that isn't there, or an agent config format I should read next.
