Why Artifact Guard exists
AI skills can hide dangerous instructions. Check them first.
Repo scans protect the app you ship. Artifact Guard protects what you install into your coding agent — skills, tools, and instruction files that can quietly ask for secrets or remote code execution. Paste is the main path; URL acquire is a quick manifest check; neither installs or rewrites the package for you.
Use case 1
Before you install a skill
Paste or upload a SKILL.md / AGENTS.md someone shared. See whether it tries to override instructions, steal secrets, or run shell commands.
Use case 2
Before you trust a package URL
Point at a public GitHub file, npm, or PyPI URL. TrueTag pulls candidate manifests and instruction files — not a full app audit.
Use case 3
Before your agent runs it
Catch install hooks, remote script pipes, obfuscation, and invisible Unicode. You decide what to remove; signing in does not auto-fix it.
Check before you install
Paste a skill or agent file. TrueTag never runs it — it only looks for risky patterns in the text.
This is not a full app scan.
Artifact Guard checks instruction files and manifests you might install into an AI agent. For your whole product codebase, use a project scan from the dashboard.
GitHub, npm, or PyPI URL
Pulls up to ~20 candidate files (SKILL.md, AGENTS.md, package.json, workflows, MCP manifests) — not a full repository audit.
See risky patterns before you install.
- 1. Paste or upload a SKILL.md / AGENTS.md someone shared — or point at a public URL.
- 2. Read the findings — each one shows the exact line, why it matters, and what to change.
- 3. Decide — install only if you accept the risk, or copy a review draft with flagged lines removed.
Signing in does not change the analysis. It only enables an optional public share page for URL acquires.