Casefile never executes what it scans

Installing an agent capability is a surprisingly large act of trust. A skill may look like one Markdown file, but the artifact around it can contain reference material, scripts, hooks, tool permissions, symlinks, generated files, and instructions designed to shape how an agent behaves. Reviewing only the friendly description is a little like reviewing a package by reading its name.

I built Casefile to make that review mechanical. It statically scans supported skills, plugins, and marketplaces, then produces deterministic findings and an identity for the artifact it actually read.

The most important design decision is also the simplest: Casefile never executes the artifact it scans.

That boundary rules out an attractive shortcut. Dynamic probing can reveal behavior that static analysis cannot see, but the moment a scanner runs an untrusted hook or script, the scanner itself needs a sandbox, network policy, credential isolation, filesystem containment, and a much larger claim about what “safe” means. That is a different product and a different trust boundary.

Casefile stays on the static side. It looks for structural problems, missing or escaping resources, declared capabilities, network and secret access, dangerous shell patterns, supply-chain material that cannot be audited as text, and common instruction-injection signals. It also records gaps in its own analysis. An unreadable file or oversized input is not quietly treated as clean evidence.

This distinction matters: no findings and complete analysis are different statements. Strict mode makes the second one a requirement. If Casefile cannot inspect something that belongs to the artifact identity, it says so and fails closed instead of turning absence of evidence into approval.

The command is deliberately ordinary:

npx casefile@latest scan ./path/to/plugin --strict

The result can be read as text, consumed as deterministic JSON, or sent to code-scanning systems as SARIF. Findings describe observable static evidence. They are not accusations about an author’s intent, and they are not proof that an artifact is behaviorally safe.

I keep returning to that limitation because good security tools should make their boundary more visible, not less. Casefile is useful precisely because its claim is narrow: these are the bytes, this is what static analysis found, this is what it could not inspect, and this is the identity you can compare later.

Trust still belongs to the operator. Casefile makes the evidence reproducible enough for that decision to be deliberate.