Security
Plugin
semia
Security audit for AI agent skills. Know what a skill can do before you trust it. Agent skills are markdown files with embedded shell commands, network calls, and tool invocations. They run with **your credentials, on your machine, with your data**.
Plugin Signal66/100Solid
maintained90
capable34
documented75
adopted59
Install on Claude Code
> /plugin marketplace add berabuddies/Semia> /plugin install semia@semia
What's inside
Skills
4/semiaAudit an agent skill with Semia inside Claude Code. Use when the user asks to run `semia scan <path>`, "Run Semia audit on this skill", or audit a skill/plugin for behavior risk./semiaAudit an agent skill with Semia inside Codex. Use when the user asks to run `semia scan <path>`, "Run Semia audit on this skill", or audit a skill/plugin for behavior risk./semiaAudit an agent skill with Semia inside OpenClaw. Use when the user asks to run `semia scan <path>`, "Run Semia audit on this skill", or audit a skill/plugin for behavior risk./semiaAudit an agent skill with Semia Skill Behavior Mapping. Use when the user asks to run `semia scan <path>`, "Run Semia audit on this skill", audit a skill package, or review a skill/integration for capability, data-flow, secret, installer, network, filesystem, or policy risk.
README
1Semia
Security audit for AI agent skills. Know what a skill can do before you trust it.
Agent skills are markdown files with embedded shell commands, network calls, and tool invocations. They run with your credentials, on your machine, with your data. Semia reads a skill as data — never executes it — and produces an evidence-backed report of every capability it may exercise.
It is the difference between
"I trust this skill because the README looks fine."
and
"I trust this skill because Semia extracted 14 actions, 6 effects, and 2 secret reads — and every one is grounded in a specific source line."
Quick example
Pick whichever fits how you already work.
As a CLI
pip install semia-audit
semia scan ./some-skill
scan does prepare → synthesize (via your configured LLM provider) →
detect → report in one shot. Output lands under
.semia/runs/<skill-slug>/ by default — pass --out <path> to override.
You'll need an LLM provider configured first — see
Set up an LLM provider below.
Inside Codex, Claude Code, or OpenClaw
Install the plugin once. Each host has its own flow.
Codex — pick either path:
Shell (scripts and CI):
codex plugin marketplace add berabuddies/Semia
Then enable the plugin by appending to ~/.codex/config.toml:
[plugins."semia@semia"]
enabled = true
Interactive plugin manager inside the Codex CLI:
- Launch
codex. - Inside Codex, input
/plugins(plural — opens the plugin panel). - Press ← (Left) to enter Add marketplace.
- Enter
berabuddies/Semia. - Back in the plugin panel, toggle
semiaon from the newly-added marketplace.
Claude Code — pick either path:
Shell (one-liner):
claude plugin marketplace add berabuddies/Semia
claude plugin install semia@semia
Interactive plugin manager inside the Claude Code CLI:
- Launch
claude. - Inside Claude Code, input
/plugins(plural — opens the plugin panel). - Press → (Right) twice and select Add Marketplace.
- Enter
berabuddies/Semia.
Either path registers the marketplace; finish installing semia from
the panel or with claude plugin install semia@semia.
OpenClaw — one shell command registers the marketplace and installs:
openclaw plugins install clawhub:semia
Then in any chat with the host agent just ask:
Run Semia audit on ./some-skill
The host agent itself acts as the synthesize step — no API key needed.
The bundled semia.pyz handles prepare / detect / report deterministically.
Fix what Semia finds
semia repair .semia/runs/some-skill --from-scan
repair reads the findings and synthesized facts from an existing scan,
traces each violation back through the Datalog rules to identify the root
cause, then calls an LLM to generate a SKILL.md patch — either fixing
the problematic content directly or adding specific security constraints.
# Or scan + repair in one shot:
semia repair ./some-skill
Outputs
You get report.md — findings ranked by severity, every one tied to a
specific source line. Need SARIF 2.1.0
for GitHub Code Scanning, or structured JSON for downstream tooling? One
more command:
semia report .semia/runs/some-skill --format sarif # for GitHub Code Scanning
semia report .semia/runs/some-skill --format json # structured payload
Set up an LLM provider
semia scan needs an LLM for the synthesize step (the other three
stages are deterministic, no key required). If you run Semia via a host
plugin (Codex / Claude Code / OpenClaw) skip this — the host agent already
does synthesize for you.
Four providers are supported. Pick one and export its credentials:
# OpenAI Responses API — default; also works for DeepSeek / OpenRouter / vLLM
export OPENAI_API_KEY=sk-...
# optional: export OPENAI_BASE_URL=https://api.deepseek.com/v1
# Anthropic Messages API
export SEMIA_LLM_PROVIDER=anthropic
export ANTHROPIC_API_KEY=sk-ant-...
# optional: export ANTHROPIC_BASE_URL=https://api.anthropic.com
# Locally-installed Claude Code CLI (uses your Claude Code login)
export SEMIA_LLM_PROVIDER=claude
# Locally-installed Codex CLI (uses your Codex login)
export SEMIA_LLM_PROVIDER=codex
Override the model with --model <name> on any semia scan invocation, or
persist it via SEMIA_LLM_MODEL. Models are free-form strings — anything
the endpoint accepts (gpt-5.5, deepseek-v4, claude-opus-4-7, …).
See Configuration for the full provider matrix, base-URL support, timeout/retry knobs, and synthesis-loop tuning.
What you get
A run writes everything under .semia/runs/<run-id>/. Most users only
ever open the reports:
| Report | When |
|---|---|
report.md | always produced by semia scan — read this first |
report.sarif.json | on demand via semia report --format sarif — feed to GitHub Code Scanning |
report.json | on demand via semia report --format json — structured payload (check + evidence + detector) for programmatic consumers |
Because every finding traces back to a source line, the SARIF drops cleanly into GitHub Code Scanning and reviewers see annotations directly on the skill PR.
| Artifact | Purpose |
|---|---|
synthesized_facts.dl | the behavior map (Datalog facts) — re-queryable |
detection_findings.dl | findings derived by rule evaluation |
prepared_skill.md | normalized skill text with stable line anchors |
prepare_units.json | reference units the evidence text aligns against |
synthesis_metadata.json | provider, model, retries, score, stop reason |
run_manifest.json | end-to-end manifest of the run |
repair_result.json | repair outcomes (when semia repair is run) |
patched/SKILL.md | the repaired SKILL.md (when semia repair is run) |
More docs
- Advanced usage covers the worked example, trust model, installation, configuration, and common workflows.
- Development covers the repository layout and local development workflow.
Project background
The technique behind Semia is described in the Semia paper (arXiv:2605.00314 · PDF). Semia is the deterministic acceptance boundary around behavior mapping: agents may extract facts, but only checked, evidence-grounded facts make it into a report.
Security
To report a security vulnerability, see SECURITY.md. Please do not file public GitHub issues for security problems.
Contributing
Contributions are welcome — bug reports, documentation fixes, detector rules, and code. See CONTRIBUTING.md for the workflow and the DCO sign-off requirement.
License
Semia is released under the Apache License 2.0. Copyright 2026 RiemaLabs.
Citation
If you use this tool, please cite our paper:
@misc{wen2026semia,
title = {Semia: Auditing Agent Skills via Constraint-Guided Representation Synthesis},
author = {Wen, Hongbo and Li, Ying and Liu, Hanzhi and Shou, Chaofan and Chen, Yanju and Tian, Yuan and Feng, Yu},
year = {2026},
eprint = {2605.00314},
archivePrefix = {arXiv},
primaryClass = {cs.CR},
doi = {10.48550/arXiv.2605.00314},
url = {https://arxiv.org/abs/2605.00314}
}
File tree
360berabuddies/SemiaView on GitHub
.agents/
plugins/
marketplace.json
.claude-plugin/
marketplace.json
.codecov.yml
.env.example
.gitattributes
.github/
dependabot.yml
scripts/
assemble_plugin_skills.py
build_zipapp.py
check_changelog.py
check_release_files.py
check_sdist_contents.py
package_build_check.py
precommit_bundle_plugins.sh
validate_plugin_manifests.py
workflows/
ci.yml
lint.yml
release.yml
.gitignore
.gitleaks.toml
.pre-commit-config.yaml
ADVANCED_USAGE.md
build_backend/
semia_build.py
CHANGELOG.md
CONTRIBUTING.md
DEVELOPMENT.md
docs/
architecture.md
plugin-protocol.md
release.md
supply-chain.md
EXAMPLE.md
LICENSE
Makefile
NOTICE
packages/
semia-cli/
src/
semia_cli/
__init__.py
__main__.py
core_adapter.py
llm_adapter.py
llm_config.py
llm_providers.py
main.py
recommendation.py
repair.py
synthesis_loop.py
synthesis_patch.py
semia-core/
src/
semia_core/
__init__.py
artifacts.py
checker.py
datalog_eval/
__init__.py
engine.py
parser.py
detector.py
evidence.py
facts.py
parsers/
__init__.py
javascript.py
markdown.py
python.py
shell.py
pipeline.py
prepare.py
repair.py
report.py
rules/
sdl/
skill_description_lang.dl
skill_dl_static_analysis.dl
schema.py
semia-plugins/
claude-code/
.claude-plugin/
plugin.json
bin/
semia.pyz
skills/
semia/
_host.md
SKILL.md
codex/
.codex-plugin/
plugin.json
bin/
semia.pyz
skills/
semia/
_host.md
SKILL.md
openclaw/
skills/
semia/
_host.md
SKILL.md
README.md
shared/
skills/
semia/
SKILL.md
PRIVACY.md
pyproject.toml
README.md
SECURITY.md
tests/
__init__.py
cli/
__init__.py
test_llm_adapter.py
test_recommendation.py
test_repair.py
test_semia_cli_integration.py
test_semia_cli.py
core/
__init__.py
test_datalog_eval.py
test_detector_report.py
test_facts_checker_evidence.py
test_pipeline.py
test_prepare.py
test_repair.py
test_skill_corpus.py
fixtures/
README.md
skills/
10e9928a/
email-daily-summary/
_meta.json
SKILL.md
2winter-dev/
fennecseo-audit/
_meta.json
fennec-seo_zh.md
SKILL.md
abdullah4ai/
council-builder/
_meta.json
assets/
ADAPTIVE-ROUTING-LEARNING-TEMPLATE.md
AGENT-AGENTS-TEMPLATE.md
LEARNING-METRICS-TEMPLATE.json
LEARNINGS-TEMPLATE.md
ROOT-AGENTS-TEMPLATE.md
SOUL-TEMPLATE.md
references/
adaptive-routing.md
coordination-patterns.md
example-councils.md
self-improvement.md
soul-philosophy.md
scripts/
init-council.sh
SKILL.md
aiwithabidi/
a6-gemini-video-analyzer/
_meta.json
references/
gemini-files-api.md
scripts/
analyze.py
manage_files.py
SKILL.md
autogame-17/
feishu-post/
_meta.json
debug_msg.js
emoji-map.js
index.js
package-lock.json
package.json
README.md
send.js
SKILL.md
utils/
feishu-client.js
markdown-parser.js
baokui/
pdf-ocr-layout/
_meta.json
script/
glm_ocr_extract.py
glm_ocr_pipeline.py
glm_understanding.py
SKILL_zh.md
SKILL.md
bavxhack/
create-videoconference/
_meta.json
index.js
package.json
README.md
SKILL.md
contrario/
aetherlang-chef/
_meta.json
aetherlang-chef/
SKILL.md
SKILL.md
crossallen/
regex-assistant/
_meta.json
script/
main.py
SKILL.md
echennells/
sparkbtcbot-proxy-deploy/
_meta.json
SKILL.md
epheterson/
mcp-applemusic/
_meta.json
SKILL.md
f-liva/
ryot/
_meta.json
CHANGELOG.md
package.json
PUBLISHING.md
scripts/
ryot_api.py
ryot_calendar.py
ryot_collections.py
ryot_reviews.py
ryot_stats.py
ryot-mark-episodes.py
setup-automation.sh
SKILL.md
hightower6eu/
x-trends-nvdfx/
_meta.json
SKILL.md
youtube-thumbnail-grabber-rzncj/
_meta.json
SKILL.md
ivangdavila/
goals/
_meta.json
SKILL.md
japanese/
_meta.json
SKILL.md
jordanprater/
youtube-summarize/
_meta.json
SKILL.md
youtube-video-downloader/
_meta.json
SKILL.md
kgeesawor/
discord-soul/
_meta.json
README.md
references/
lancedb.md
security.md
scripts/
create_agent.sh
evaluate-safety.py
generate_daily_memory.py
incremental_export.sh
ingest_rich.py
regex-filter.py
secure-pipeline.sh
simulate_growth.py
update_agent.sh
SKILL.md
templates/
AGENTS.md
HEARTBEAT.md
LEARNINGS.md
MEMORY.md
SOUL.md
TOOLS.md
kintupercy/
deadclaw/
_meta.json
docs/
android-widget-guide.md
clawhub-listing.md
competitive-notes.md
iphone-shortcut-guide.md
launch-post.md
roadmap.md
README.md
scripts/
kill.sh
restore.sh
status.sh
watchdog.sh
SKILL.md
ui/
deadclaw-button.html
lijie420461340/
md-to-office/
_meta.json
SKILL.md
lvy19811120-gif/
polymarketagent/
_meta.json
SKILL.md
misaka43fd/
mulerouter-skills/
_meta.json
core/
__init__.py
client.py
config.py
image.py
registry.py
task.py
models/
__init__.py
alibaba/
__init__.py
wan2.1-kf2v-plus/
generation.py
wan2.1-vace-plus/
generation.py
wan2.2-i2v-flash/
generation.py
wan2.2-i2v-plus/
generation.py
wan2.2-t2v-plus/
generation.py
wan2.5-i2i-preview/
generation.py
wan2.5-i2v-preview/
generation.py
wan2.5-t2i-preview/
generation.py
wan2.5-t2v-preview/
generation.py
wan2.6-i2v/
__init__.py
generation.py
wan2.6-image/
__init__.py
generation.py
wan2.6-t2i/
__init__.py
generation.py
wan2.6-t2v/
__init__.py
generation.py
base.py
google/
__init__.py
nano-banana/
nano-banana-pro/
__init__.py
edit.py
generation.py
__init__.py
edit.py
generation.py
veo3/
generation.py
midjourney/
__init__.py
diffusion/
generation.py
video/
generation.py
openai/
__init__.py
sora2/
generation.py
pyproject.toml
README.md
references/
MODELS.md
REFERENCE.md
scripts/
list_models.py
SKILL.md
tests/
__init__.py
test_client.py
test_config.py
test_registry.py
test_task.py
moonshine-100rze/
excel-1kl/
_meta.json
SKILL.md
twitter-6ql/
_meta.json
... 141 moreFAQ
semia is a Claude Code plugin with 4 hand-picked skills for security work, indexed on Flowy. Install it with the command on its page. It includes semia, semia, semia. Its skills do not fire on their own yet. Request auto-invocation to have Flowy route them as you prompt. Free and open source.
- What is semia?
- Security audit for AI agent skills. Know what a skill can do before you trust it. Agent skills are markdown files with embedded shell commands, network calls, and tool invocations. They run with **your credentials, on your machine, with your data**.
- How do I install semia?
- Run these in Claude Code: /plugin marketplace add berabuddies/Semia then /plugin install semia@semia. Then prompt normally.
- Does semia auto-invoke its skills?
- Not yet. It is indexed on Flowy as a plain plugin. Request auto-invocation on its page and Flowy will route its skills for you as you prompt.
- Is semia free?
- Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.