Run any Skill in Manus with one click

scan-package

Stars4

Forks2

UpdatedFebruary 22, 2026 at 21:19

Scan a pip or npm package before installation using Sigil. Use when installing dependencies, adding new packages, or when package behavior seems suspicious. Auto-invoke before pip install or npm install commands.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

NOMARJ

NOMARJ/sigil

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name	scan-package
description	Scan a pip or npm package before installation using Sigil. Use when installing dependencies, adding new packages, or when package behavior seems suspicious. Auto-invoke before pip install or npm install commands.
allowed-tools	Bash(./bin/sigil *)

Package Security Scan

Scan a package before installation:

Identify package type (pip or npm)
Run appropriate Sigil scan:
- ./bin/sigil pip <package> for Python packages
- ./bin/sigil npm <package> for Node packages
Review quarantine findings
Recommend approve/reject based on risk score

Critical patterns to flag:

Install hooks (setup.py cmdclass, npm postinstall)
Eval/exec/pickle usage
Network exfiltration (webhooks, DNS tunneling)
Credential access (ENV vars, SSH keys)
Code obfuscation (base64, charCode)

Present findings and guide the user through quarantine approval.

More from this repository

same repository

sigil-scan

NOMARJ/sigil

Automated security auditing for AI agent code. Scans repos, packages, MCP servers, and installed skills for malicious patterns using eight-phase analysis: install hooks, dangerous code patterns, network exfiltration, credential access, obfuscation, provenance, prompt injection, and skill security. Use when: cloning repos, installing packages, reviewing MCP servers, auditing skills, scanning code before execution, or when asked to check if something is safe, audit code, scan for malware, review dependencies.

2026-06-144

brutal-business-diagnosis

NOMARJ/sigil

Act as a brutally honest McKinsey-level strategy consultant to diagnose the real underlying problems hurting a business's growth, profitability, or traction. Use this skill whenever someone asks to diagnose their business, wants honest feedback on why their business isn't growing, says things like 'what's wrong with my business', 'why isn't this working', 'roast my startup', 'tear apart my business', 'honest assessment', 'brutal feedback', 'diagnose my company', or asks for a strategy consultant perspective. Also trigger when users share a business description and ask what's holding them back.

2026-04-034

founder-blind-spot-finder

NOMARJ/sigil

Identify a founder's biggest blind spots — flawed assumptions, strategic misjudgments, and decisions that feel right but are damaging the business long-term. Use this skill whenever someone asks about their blind spots, wants to know what they're missing, says things like 'what am I not seeing', 'where am I wrong', 'challenge my assumptions', 'play devil's advocate on my business', 'what would I regret in 2 years', 'poke holes in my strategy', or asks for a fresh perspective from someone who's seen startups fail. Also trigger when a founder seems very confident and asks for feedback — confidence is often where blind spots hide.

2026-04-034

growth-bottleneck-finder

NOMARJ/sigil

Identify the single biggest bottleneck preventing faster business growth by examining the offer, audience targeting, distribution channels, messaging, pricing, and funnel structure. Use this skill whenever someone asks why they aren't growing faster, wants to find their growth bottleneck, says things like 'what's limiting our growth', 'why are we stuck', 'we've plateaued', 'growth has stalled', 'how do we grow faster', 'what's the constraint', 'find the bottleneck', 'why aren't we scaling', or describes a business that should be growing but isn't. Also trigger when a founder shares decent traction but frustration about pace.

2026-04-034

market-reality-check

NOMARJ/sigil

Evaluate a business idea or offer through the lens of real market demand — is the problem truly painful, the solution compelling, and the positioning differentiated? Use this skill whenever someone asks for a market reality check, wants to validate a business idea, says things like 'is there a market for this', 'will people pay for this', 'is my idea viable', 'validate my concept', 'is this a real problem', 'market validation', 'demand check', 'would you buy this', or shares a new business concept and wants honest market feedback. Also trigger when someone is about to invest significant time or money into an unvalidated idea.

2026-04-034

offer-strength-test

NOMARJ/sigil

Analyze a product or service offer with ruthless objectivity to determine if the value proposition is strong enough to drive real demand. Use this skill whenever someone asks to evaluate their offer, test their value proposition, says things like 'is my offer good enough', 'rate my offer', 'test my pricing', 'is this compelling', 'would you buy this', 'critique my product', 'evaluate my service', 'offer teardown', 'value prop test', 'is my pricing right', or shares a product/service and wants to know if it will sell. Also trigger when someone is about to launch a new offer, restructuring their pricing, or struggling with low conversion rates that may be offer-related.

2026-04-034

name	scan-package
description	Scan a pip or npm package before installation using Sigil. Use when installing dependencies, adding new packages, or when package behavior seems suspicious. Auto-invoke before pip install or npm install commands.
allowed-tools	Bash(./bin/sigil *)

Package Security Scan

Scan a package before installation:

Identify package type (pip or npm)
Run appropriate Sigil scan:
- ./bin/sigil pip <package> for Python packages
- ./bin/sigil npm <package> for Node packages
Review quarantine findings
Recommend approve/reject based on risk score

Critical patterns to flag:

Install hooks (setup.py cmdclass, npm postinstall)
Eval/exec/pickle usage
Network exfiltration (webhooks, DNS tunneling)
Credential access (ENV vars, SSH keys)
Code obfuscation (base64, charCode)

Present findings and guide the user through quarantine approval.