IGLIGQ
Menu
Private by designFree local preview where supported; no script execution.
Static reviewSubmitted scripts are inspected, not executed.
Evidence-ledFindings are organized by severity and review confidence.
Version scopedReports are tied to the submitted package version.

Install-time review for AI skills and agent packages.

Check AI skills and agent packages before you install them

Paste a skill, upload a package, or review an agent config. IGLIGQ checks risky permissions, hidden data access, external calls and unsafe instructions before you trust it.

  • Static analysis onlyIGLIGQ reviews instructions, manifests and package signals without running submitted code.
  • No code executionScripts are treated as untrusted input. IGLIGQ does not execute uploaded or pasted scripts.
  • Free local previewSupported free checks run locally in your browser where possible. Do not submit secrets.
  • Human review availableTeams can request a human-reviewed report when they need a clearer trust record.
Run free risk previewSee a sample report

AI Skill & Agent Package Security Checker

Quick Risk Preview

No installation. No sign-up. Static review only.

URL mode is a guided example. For a real free check, paste instructions or upload a supported local file below. Do not submit secrets.

Select scan target

Advanced options

Static scan preset: structure, permissions, network, filesystem, behavior-influencing instructions, secrets, dependencies and install readiness.

Ready for a quick review. No install required.

  1. Intake
  2. Static analysis
  3. Capability extraction
  4. Risk rules
  5. Report ready

Example review output

gmail-workflow-agent

Agent Package / Medium confidence / Static analysis only / No code execution

72/100Review Required
Critical
0
High
2
Medium
4
Low
5
HighExternal service call requires reviewNET-002 / scripts/send.ts:42 / High
MediumInstructions may reduce human oversightINSTR-004 / SKILL.md:18-26 / Medium
Open example report
MethodologyScoring model, confidence labels and no-code-execution policy.Sample reportScore, findings, package capabilities and stated-purpose review.Verified AuditHuman review, public badge and enterprise private review path.

How the checker works

IGLIGQ separates the free local preview from deeper human review.

Read methodology
01

Intake

Paste instructions, provide a package URL, upload a ZIP or review an MCP/plugin manifest.

02

Static analysis

Check structure, permissions, dependency hints, secret patterns, network clues and instructions that may influence agent behavior.

03

Capability extraction

Translate technical signals into read, write, network, shell, secret and prompt actions.

04

Report generation

Show score, confidence, where risks were found, recommendations and the next review option.

What risks it checks

Each finding shows severity, confidence, where the risk was found and the recommended action.

Structure

Manifest completeness, schema clarity and artifact organization.

Permissions

Declared or implied access to files, tools, accounts and actions.

Network

External endpoints, callbacks, webhook references and data transfer signals.

Filesystem

Read/write behavior, export paths and local storage indicators.

Behavior-influencing instructions

Instruction override, autonomy and human-approval bypass wording.

Secrets

Credential patterns, env usage and unclear key-handling instructions.

Dependencies

Install scripts, unpinned packages and dependency manifest issues.

Install readiness

Logging, approval gates, disclosure quality and failure handling.

Report section

What the package can access and do

A structured view of what the package appears able to read, write, call, execute or expose.

Capability evidence example
CapabilityActionSeverityConfidenceEvidence
Network accessCalls external mail APIHighHighscripts/send.ts -> fetch(api.mailprovider.example)
Filesystem writeWrites local export filesMediumMediumsrc/exporter.ts -> fs.writeFile(outputPath)
Behavior-influencing instructionsContains oversight-reduction wordingMediumMediumSKILL.md contains autonomous retry and approval-bypass language
Secrets handlingReads environment variablesMediumLowconfig/mail.ts -> process.env.MAIL_API_TOKEN

Report section

Stated purpose and observed behavior

IGLIGQ compares stated purpose with visible behavior, permissions, external services and risky instructions.

Stated purpose

  • Summarizes Gmail threads
  • Drafts follow-up replies

Observed behavior

  • Calls external mail API
  • Writes local export files

Mismatch labels

  • External data transfer not disclosed
  • Storage behavior not disclosed

Human review option

Verified Audit for public trust

Request a human-reviewed report when you need a public badge, team-ready audit report or private team review. The result reflects the submitted package and the evidence found during review.

Request verified auditVerified Audit details

Run Free Quick Risk Preview

Use the local preview for pasted text or a supported file. Do not submit secrets. Scripts are inspected, not executed. The free preview shows summary counts only and does not create a paid report.

  • Maximum package size: 10 MB
  • Maximum files per ZIP: 150
  • Maximum scripts per package: 20
  • Maximum readable text: 300,000 characters

Local preview runs in this browser. Files are not uploaded for Quick Risk Preview.

View example result before running a preview

Example only. This sample is not generated from your input and is not a paid audit result.

Inventory
Example: 3 readable files and 1 script
Security
Example: credential and external URL signals
Privacy Handling
Example: broad data access wording needs review
Output
Example only; exact findings are reserved for paid reports