Audit every skill before your agent runs it.
An open-weight gate that scans the skills you give Claude Code and Codex for prompt injection, then lets only the safe ones through.
score on host
The skills nobody audits
91% of the malicious skills worked through prompt injection. Source: Snyk ToxicSkills audit of 3,984 published skills, Feb 2026.
One pipeline. The model advises, your host decides.
Four stages turn an untrusted file into a verdict you can trust.
Scan
A regex and Unicode pass flags the obvious stuff: exfil URLs, shell payloads, hidden characters.
Classify
An open-weight model reads it as inert data and returns its findings twice, for consistency.
Decide
A function on your host turns findings into the verdict. The model gets no vote.
Gate
Safe skills load. Everything else is blocked with a reason. Errors fail closed.
For every skill, Jenz spawns a panel of security agents.
Each agent reads the skill as inert data, quoted and never executed, and hunts a different class of attack against a known threat catalog. They return findings, not verdicts.
Hunts attempts to read credentials, env files, or your repo and ship them off-box.
Flags shell payloads, destructive actions, and tool or permission abuse.
Catches prompt injection, jailbreaks, and “ignore previous instructions” overrides.
Built to be trusted, not just clever.
Every finding maps to the attack frameworks the industry already trusts, OWASP and MITRE. The verdict is computed on your host, never by the model. Safe is something a skill earns.
Don’t trust a skill you haven’t audited.
Open-source, open-weight, fail-closed. Run your first skill through the gate in under a minute.