Media
5 items
Description
Protects any AI bot that installs skills: grades SKILL.md on ClawHub, GitHub, npm and more; warns on copied installs. Ironheights grades AI agent skills before you install them, right in your browser. A "skill" is any folder with a SKILL.md: the add-ons that OpenClaw, Claude, Grok Bot, Codex, Cursor and other AI bots load as instructions and scripts. A malicious one can tell your agent to run a remote installer, read your SSH keys or API tokens, or send them somewhere. Ironheights protects any AI bot's skills, whichever marketplace they come from. What it does • Grade badge (A–F) next to the title on ClawHub skill pages and on GitHub folders that contain a SKILL.md. Hover for the top findings, click for the full report. • Right-click any skill link (GitHub, ClawHub, grokpot, or a raw SKILL.md) → "Scan with Ironheights" for a full report: severity, rule, file and line, the exact evidence, and how to fix it. • Paste a link in the popup to scan it. How it checks • The same rule engine as the open-source Ironheights CLI (npm: ironheights): pipe-to-shell installers, encoded payloads, credential and secret access, exfiltration, prompt injection, persistence, privilege escalation, risky MCP config and more. • Skill files are downloaded as plain text and never executed. • If any file could not be scanned (binaries, very large files), you get "Incomplete" instead of a letter. Ironheights won't give a grade for a review it didn't do. Privacy • Scans run on your device. Nothing about you, your browsing or the skills you scan is sent to Ironheights. There's no account, no analytics and no telemetry. • The only network requests fetch the skill files you asked about, directly from GitHub, ClawHub or grokpot. No findings is not proof of safety. Ironheights catches known patterns, so still read what a skill does before you install it. For install-time baselines and a runtime guard, use the CLI: https://www.ironheights.dev Website: https://www.ironheights.dev Open source (Apache-2.0): https://github.com/Frank-Masciopinto/ironheights