.svg)
The skills your agents run are code. Vet them like code.
AI coding agents don't just write code — they load skills, subagents, MCP servers, and instruction files that tell them what to do and hand them real tools and permissions. Any one of them can carry a hidden directive to steal secrets, run destructive commands, or phone home. Heeler analyzes every agent artifact, scores how safe it is, and flags the malicious and suspicious ones before your agents ever trust them.
Skills are the new supply chain — and nobody's reading them.
A skill or agent config is just text — trivial to share, impossible to eyeball, and attack surface traditional AppSec was never built to scan.
Instructions are executable
A skill isn't documentation — it's a directive your agent will follow, using the tools and permissions you've granted. One injected line turns a helper into an exfiltration tool.
Shared, forked, trusted on sight
Skills and MCP servers get copied from teammates, marketplaces, and public repos, then trusted without review. The malicious ones look exactly like the useful ones.
They reach off your machine
Agent artifacts reference external URLs and call out to hosts no one vetted — pulling fresh instructions in at run time, long after any review would have caught them.
Every skill gets a safety score.
Heeler rates each agent artifact from 0 to 100 — 100 is safest — and sorts it into a plain-language verdict. You don't have to read the analysis; you read the number and know whether to trust it.
0–100, 100 is safest
One score captures how much risk an artifact carries, so any skill, subagent, or MCP config can be compared, ranked, and gated at a glance.
Benign, suspicious, or malicious
Every artifact resolves to one of three verdicts, each backed by the evidence that earned it — no vague ‘medium’ to argue about.
Five severity bands
Scores map to five bands, from clearly safe to actively hostile, so triage matches the real distance between ‘a little odd’ and ‘this is an attack.’
At-risk below 70
Anything scoring under 70 is flagged at-risk — the line where ‘probably fine’ ends and human review, or a hard gate, begins.
Static analysis, plus a judge that can't be fooled.
Two passes on every artifact. A static pass reads the structure and literal content; a separate, isolated model reasons about intent the way an attacker would. Neither pass runs inside your agent, and neither can be talked out of its verdict.
Reads the literal artifact
Static analysis parses the skill's structure, its instructions, and every tool and permission it requests — no execution, no guessing.
An isolated judge
A separate, purpose-built model — never the agent's own — evaluates intent in a sandbox, so a hostile skill can't use the review itself as a way in.
Hardened against injection
The judge runs behind a nonce barrier: instructions buried in the artifact can't hijack the analysis or forge a clean verdict.
Verbatim evidence
Every verdict quotes the exact lines that triggered it, so a flagged skill comes with proof you can read — not a black-box number.
Eleven ways a skill turns hostile.
Heeler classifies malicious behavior across eleven attack categories — the concrete ways an agent artifact goes from helpful to hostile — and follows the trail off your machine when it leads there.
Prompt injection & hijacking
Hidden instructions that override the agent's task, escalate its permissions, or quietly redirect what it does.
Data & secret exfiltration
Directives that harvest source, environment variables, tokens, or credentials and ship them somewhere they don't belong.
Destructive & unsafe commands
Skills that delete, overwrite, or run dangerous shell — including attempts to break out of the sandbox they were given.
Tool & permission abuse
Requests for tools, scopes, or file access far beyond the skill's stated job — the quiet setup for a later attack.
External-reference tiering
Every URL and remote host an artifact reaches is scored by trust tier, so a skill that phones home to an unknown host stands out at once.
Invocation folding
Nested and repeated invocations are collapsed into the behavior they actually add up to — an attack split across many small calls can't hide in the noise.
Vet skills before your agents trust them.
A score only helps if it lands before the skill runs. Heeler checks artifacts on demand and keeps a live catalog of everything in use — and lets your own pipelines gate on the result.
On demand or cataloged
Score a single artifact synchronously through the API, or let Heeler continuously catalog every skill, subagent, and MCP config across your org.
Your pipeline owns the gate
Your CI calls the API and decides — block a merge, warn, or record it. Heeler supplies the verdict and the evidence; you set the policy.
At-risk, surfaced
Anything under the safety threshold surfaces as at-risk with its category and evidence, so a hostile skill never quietly becomes something your agents depend on.
Know what your agents are running.
A demo scores the skills, subagents, and MCP configs already in your environment — and shows you the ones your agents should never have trusted.
