.svg)
Your agents run files nobody reviewed.
The instructions, skills, subagents, hooks and configs in your repositories are executable intent — a poisoned skill or a hidden instruction can make a trusted agent exfiltrate secrets, run malicious code, or quietly hide its own changes. Heeler finds every agent file across your repos, whichever assistant produced it, scores how dangerous it is, and tells you what it would have done.
Every agent file is a new trust decision.
Skills, MCP servers, instruction files, hooks, and agent configuration can shape what an agent reads, executes, and sends outside your environment — often with the same access as the developer running it. Traditional AppSec rarely treats those files as a supply chain of their own.
Instructions are executable
A skill is a directive your agent will follow with the permissions you've granted — one injected line turns a helper into an exfiltration tool.
Trusted on sight
Skills and MCP servers get copied from teammates and marketplaces and trusted without review. The malicious ones look exactly like the useful ones.
Shadow AI spreads
New agents, skills, and servers appear across your org faster than anyone catalogs them — you can't secure what you can't see.
Four kinds of file. Every major assistant.
AI coding agents run on files that ship in your repo — instructions, skills, subagents, hook scripts, and configuration. Those files are executable intent. Heeler finds every one of them, whichever assistant produced it, and scores how dangerous it is.
Instructions
Top-level agent guidance — CLAUDE.md, AGENTS.md, GEMINI.md, and Cursor rules. The file that shapes everything the agent does next.
Skills
A SKILL.md and its member scripts and assets — under .claude, .cursor, .gemini, .opencode, or the portable .agents layout.
Subagents
Delegated agents with their own instructions and their own reach, defined across Claude, Cursor, Gemini, Codex, and OpenCode layouts.
Hook scripts and config
Scripts an agent runs on an event, plus agent and MCP configuration — .mcp.json, settings files, config.toml, and plugin manifests.
One score, three factors, and a verdict.
Every agent file gets a 0–100 safety score — higher is safer — and anything below 70 is flagged At Risk. The score rolls up three independent factors, and the rollup is deterministic: the same file content produces the same score every time.
0–100, higher is safer
One number you can rank, compare and gate on. Below 70 is At Risk — the line where human review begins. The more findings a file carries, and the more severe they are, the lower it lands.
Static Risk
Deterministic rule and pattern findings in the file itself, each carrying a fixed severity. Same content, same findings, every time.
LLM Risk
A model's assessment of what the file actually instructs the agent to do — the risky intent no pattern can catch.
External Risk
The reputation of the outside systems the file reaches. A skill quietly phoning home to an unrecognized host raises its own risk.
Assessed intent
Benign, Suspicious or Malicious — a verdict with a stated confidence. Suspicious caps the score into the At Risk band; Malicious caps it lower still, no matter what the factors add up to.
STATIC FINDINGS
What deterministic analysis catches.
Before any model reads the file, a fixed set of rules does. Each finding carries a set severity, and the same file content always produces the same result — so these are the findings you can write policy against.
Dangerous dynamic-context command
A command that runs during preprocessing, before the model ever sees the rendered instructions — so the agent cannot inspect it or refuse. Triggers on network tools, reads of .env, ~/.aws or ~/.ssh, and references to credential environment variables.
Invisible Unicode
Hidden characters that conceal instructions or make text render differently in review. Caught in three forms: bidirectional overrides — the classic Trojan Source technique — zero-width runs long enough to encode content, and Unicode tag characters, with a decoded preview where one is possible.
Encoded blob
Large Base64 or hex content that decodes primarily into readable text — often hidden instructions. Certificates, image data, short tokens and common hashes are deliberately excluded to keep false positives down.
Agent-invoked script
A script or shell command an agent file may execute, tagged by how it runs — automatically via a hook or event, or at the agent's discretion because the file encourages it. The distinction is the whole point.
Referenced external system
Every external URL or domain the file references — APIs, docs, MCP servers, cloud services. A reference is not automatically unsafe; the point is that someone gets to decide whether each one is expected.
Wildcard permission in config
An over-broad permission grant in agent configuration — the kind that quietly hands an agent far more reach than the task in front of it needs.
Eleven ways an agent file turns hostile.
Patterns catch what a file contains. A model reads each file for the risky intent a pattern can't express — and every finding it returns lands in one of eleven categories, with a severity set by the judge.
Prompt Injection
Instructions that override, redirect or manipulate the agent away from the user's task, through hidden, disguised or higher-priority directives.
Data Exfiltration
Instructions to transmit source code, repository contents, runtime context, secrets or credentials to an external destination.
Remote Code Execution
Instructions to download and execute remote code — shell scripts, installers or encoded payloads retrieved from outside. The higher-risk supply-chain case.
Code Execution
Instructions to run local scripts or commands already present in the repository — through hooks, task definitions or imperative run steps.
Destructive Action
Irreversible operations — force-pushing a repository, mass deletion, dropping a database.
Privilege Escalation
Attempts to gain elevated privileges or bypass protections — disabling sandboxing, skipping approval workflows, removing execution safeguards.
Secrets Exposure
Instructions to read, display, log, forward or otherwise expose credential and secret values.
Obfuscation
Behaviour deliberately hidden or obscured so its true effect isn't obvious to anyone reviewing the file.
Deception
Instructions to conceal activity, suppress output or misrepresent what changed — aimed at the reviewer, not the system.
Unsafe External Reference
A reference to an external system in a risky way — an untrusted host, plain HTTP, a raw IP address, or a URL shortener.
Other
Risky behaviour that doesn't fit the categories above — still caught, still scored, still surfaced.
EXTERNAL REFERENCES
Where the file reaches, and whether you trust it.
A skill that contacts your own build server and one that contacts an unrecognized host can look identical in review. Heeler tiers every outbound system by reputation and feeds that into the score — and lets you settle the ones that are genuinely yours.
Trusted developer infrastructure
Recognized package registries, source hosts and cloud services. Expected traffic that shouldn't cost a file any score.
Unrecognized hosts
Not known to be malicious, not known at all — the tier that deserves a human glance, and the one a reviewer would otherwise skim past.
High-risk hosts
Systems with a reputation that makes the reference itself the finding, regardless of what the surrounding instructions claim.
Allowlist what's actually yours
Approve a domain from a file's detail and external-system risk drops on the next rescore. It narrows only that risk — hidden instructions, plain HTTP, raw IPs and model-detected behaviour all still surface.
Know what your agents are running.
Connect your source control and Heeler inventories the agent files already in your repositories — with a score, a verdict, and the exact lines that earned it.
