Adversarial security review for AI skills, repos, MCP servers, and packages before you install them. A read-only scanner plus a five-persona reasoning pass, ending in a GO / GO WITH MITIGATIONS / NO-GO verdict.
Audit, grade, and rewrite generic AI-slop patterns in prose, social posts, UI/design, and code. Use when asked to de-slop writing, humanize AI copy, grade a draft, review a landing page or generated interface, remove vague claims and repetitive rhetoric, or inspect AI-written code for generic abstractions and happy-path-only logic.
@howshannonFAQ
trust-issues is a Claude Code plugin with 1 hand-picked skill for security work, indexed on Flowy. Install it with the command on its page. It includes trust-issues. Its skills do not fire on their own yet. Request auto-invocation to have Flowy route them as you prompt. Free and open source.
> /plugin marketplace add howshannon/trust-issues> /plugin install trust-issues@trust-issues
Installing an agent skill or an npm package runs someone else's code on your machine, often with access to your files and credentials. Public marketplaces have been seeded with malicious skills that lifted saved logins and wallet files the moment someone installed them. Trust Issues lets you check something before you run it instead of finding out afterward.
You point it at a repo, a skill, an MCP server, or a package, and it does an attacker-minded review and hands you a verdict with the findings behind it.
The review has two layers. First, a read-only scanner does a fast pass over 14 categories of risk, from install hooks and obfuscated payloads to leaked secrets and hidden instructions. Then a five-persona adversarial read looks at what the scanner surfaced and reasons about intent, which is the part a keyword search can't do.
The scanner never runs the code it reviews — it only reads files. It also does no online research: the "search for current attack techniques" step happens in the full workflow, run by the agent or person, not by the shell script. Treat whatever that research pulls in as untrusted evidence, since web pages and repos can themselves carry prompt injection, not as instructions to act on.
Signature scanners exist, and they have a documented weakness. When researchers lightly disguised about 1,600 real malicious skills, most of them slipped past eight popular scanners. Pattern matching is straightforward to evade. Trust Issues relies on reasoning instead, treats prompt injection inside SKILL.md and MCP tool descriptions as a primary threat, and searches for current attack techniques at the start of every run so its knowledge stays current. It is also clear that a clean scan proves very little on its own, and that your real protection is a sandbox and least privilege.
Most scanners quote an accuracy number without publishing the test set behind it. This one ships the corpus so you can verify it, and it reports both recall and false positives — because a scanner that catches malware but flags every benign install hook is unusable.
Against a public corpus of 11 known-malicious and 8 benign fixtures, the scanner catches 10 of the 11 malicious samples in the correct category. The one miss is a deliberately evasive sample, reported on purpose — that case is the argument for the human read. It also surfaces 6 of the 8 benign samples for manual review; those are false positives the five-persona reasoning pass is meant to clear, reported openly rather than hidden behind the recall headline (precision ≈ 63%).
The full numbers — recall, false-positive rate, and precision — are versioned in benchmark/RESULTS.md and regenerated on every ruleset change with bash benchmark/run_benchmark.sh --results. Post-release evasions that beat the scanner are welcome as PRs into benchmark/fixtures/community/, so the corpus grows with real-world attempts instead of freezing at launch.
Run it yourself with bash benchmark/run_benchmark.sh. Nothing in the fixtures folder is ever executed.
The manual read applies five lenses:
That last lens is the one generic code review skips, and it's the most important for an agent skill.
Any agent — one command. Works with Claude Code, Codex, Cursor, and other agents that support the open Agent Skills standard:
npx skills add howshannon/trust-issues
Claude Code
git clone https://github.com/howshannon/trust-issues
cp -R trust-issues ~/.claude/skills/
Claude Code — plugin marketplace
/plugin marketplace add howshannon/trust-issues
/plugin install trust-issues@trust-issues
Claude Desktop / Cowork / claude.ai — open Settings → Capabilities (or Skills) and add or upload the skill. You can also zip the folder as trust-issues.skill and use the Save-skill button.
Then ask for it by name: "review this before I install it: ." It also triggers on its own when you go to clone, install, or connect something you didn't write.
Install as a live checkout, then pull whenever you want the newest version:
rm -rf ~/.claude/skills/trust-issues
git clone https://github.com/howshannon/trust-issues ~/.claude/skills/trust-issues
To update later, run:
git -C ~/.claude/skills/trust-issues pull
Restart your agent (or run /reload-plugins in Claude Code) to pick up the changes.
The main use: you found a skill or repo on GitHub and want to check it before installing. Inside Claude (Code, Desktop, or Cowork) with the skill installed:
https://github.com/someone/cool-skill.You never run the target's code during this. Reviewing is not installing.
You found code somewhere else (a gist, a downloaded zip, an npm or pip package). Same move: point Claude at it with "review this before I run it: ". For a zip, unzip it into a throwaway folder first (not your projects directory), then give Claude that folder path.
You just want the fast terminal scan, without Claude. The scanner is a standalone, read-only script:
# 1. clone the target into a sandbox folder, NOT your working tree
git clone --depth 1 https://github.com/someone/cool-skill /tmp/review-target
# 2. run the scanner — it only reads files, it never executes them
bash scripts/triage_scan.sh /tmp/review-target
Read the flagged categories. A clean result means the fast pass found nothing obvious, not that the code is safe — for a real decision, run the full review in Claude.
Reviewing code is not the same as running it. Clone into a sandbox, don't install or execute the target while you're reviewing it (install hooks run code during install), and don't give an agent access to the untrusted code and your secrets at the same time.
trust-issues/
├── SKILL.md the workflow: acquire safely → research attacks → scan → 5-persona read → verdict
├── scripts/triage_scan.sh read-only static triage, 14 categories
├── references/ threat catalog + report template
├── benchmark/ labeled fixtures + recall harness
├── ARCHITECTURE.md how it's built and why
└── CONTRIBUTING.md how to add new evasion patterns
See PRIOR-ART.md. Other tools cover similar ground and some are good. This one focuses on the agent-specific attack surface and tries to be clear about the limits of what a scan can tell you.
MIT. Contributions of new evasion patterns are especially welcome.
This helps you review code. It does not guarantee that any code is safe, and it is not a substitute for a sandbox and sensible access limits. You are responsible for what you choose to run.
.claude-plugin/
marketplace.json
plugin.json
.github/
workflows/
ci.yml
.gitignore
ARCHITECTURE.md
assets/
hero.png
logo.png
mascot.png
README.md
social-preview.png
benchmark/
fixtures/
benign/
ai_detector_test.py
api_client.py
clean_SKILL.md
config.py
db_migrate.mjs
readme_with_comment.md
regex_util.js
scheduler.mjs
community/
.gitkeep
README.md
malicious/
base64_exec.py
curl_pipe_sh.sh
dynamic_eval.js
env_exfil.py
evasive_obfuscated.py
hidden_unicode_SKILL.md
miner_tor_c2.py
npm_postinstall/
package.json
prompt_injection_SKILL.md
reverse_shell.sh
ssh_key_theft.py
README.md
RESULTS.md
run_benchmark.sh
CONTRIBUTING.md
COVERAGE.md
LICENSE
PRIOR-ART.md
PRIVACY.md
README.md
references/
report-template.md
threat-catalog.md
scripts/
triage_scan.sh
SECURITY.md
SKILL.md© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic