A skill can contain more than instructions. It may bring scripts, hooks, references, and configuration that affect what an agent can do. Reading its description alone leaves much of that package unexamined.

Casefile scans those files without executing their code. It reports findings you can review, identifies the exact content it scanned, and lets you record that state for later comparison. You can use it when adopting someone else’s plugin or maintaining a collection of your own.

Inspect before installing

You need Node.js 20 or newer and a local copy of the skill, plugin, or marketplace. Point Casefile at its directory:

npx casefile@latest scan ./path/to/skill-or-plugin

Casefile recognizes supported artifact layouts and inspects eligible files for structural problems, suspicious instructions, filesystem operations, secret access, network calls, and supply-chain signals. It also records files that it could not fully analyze.

For a stricter first review, add --strict --fail-on warning. Strict mode makes incomplete analysis a failing condition; the severity threshold determines which findings block the scan.

Interpret the findings

Each finding names a rule, severity, file, and, where available, a line. Severities are critical, warning, and info. The default gate fails when a critical finding is present.

Figure 01

Read the package behind the description.

Inside a plugin
plugin/
  • SKILL.mdAgent instructions
  • hooks/hooks.jsonStartup commands
  • scripts/sync.shSupporting code
Warning

Network call

scripts/sync.sh

Where does it send data, and is that needed for the skill’s job?

Static inspection
Files are read. Scanned code is never run.

Illustrative plugin files and a static review signal. A legitimate sync script may need network access. The finding points to source you should inspect; Casefile does not execute the script or determine whether you should trust its author.

Read the relevant source and decide whether the capability matches the task. You can export JSON for automated processing or SARIF for code-scanning tools. A report is review evidence, not a certificate that a package is safe.

Record the reviewed version

A lock records the identities of the findings and files you reviewed. Keep it outside the scanned directory, since placing it inside would change the content it describes.

npx casefile@latest lock ./plugin --out ./plugin.casefile-lock.json --strict

The lock command runs a fresh scan; it does not replace the severity gate or human review. Use a stable checkout and keep the artifact unchanged between scanning and locking. Store the accepted lock somewhere that receives review too.

Check later changes

Before using an updated copy, compare it with the accepted lock:

npx casefile@latest verify ./plugin --lock ./plugin.casefile-lock.json --strict
Figure 02

An update can change what you reviewed.

Version you reviewedOriginal filesSKILL.md samesync.sh originalRecorded in lock
Updated copyChanged filesSKILL.md samesync.sh modifiedDoes not match
Verify detects the difference.

The previous review applies to the previous bytes. Inspect the update before recording a new accepted state.

Conceptual comparison, not literal CLI output. Even when a later scan reports the same findings, changed artifact bytes produce drift. Review the change before accepting a new lock; an existing lock does not approve the update.

Verification distinguishes changes in artifact bytes, findings, policy, and tool or report versions. A change calls for review; it is not automatically evidence of malicious behavior.

The commands above are convenient for a first trial. For repeatable checks in CI, pin an exact Casefile version as a development dependency and run both the scan gate and lock verification. Otherwise, a new CLI release can change the evidence between runs. The CI guide covers that setup and intentional upgrades.

What a scan cannot establish

Static analysis cannot tell you every action an agent will take at runtime, whether its advice is correct, or whether it improves your work. Casefile does not execute the scanned artifact, and a clean report cannot prove that a capability is absent.

A lock is an integrity record, not a signature proving who approved it. Its value depends on reviewing and protecting the accepted copy.

For examples of skills you can inspect and use, browse Overclock. For judging the behavior of an agent that uses a skill, see Rubrist.