garagon/aguara — Static Security Scanner for Agent Skills (16 stars, 3 days old)

GitHub | Go, MIT

Extremely new but architecturally significant. Performs static analysis on skill files (markdown, YAML, JSON) to detect threats before deployment — offline, deterministic, no LLM required. 138 detection rules across 15 categories. Companion service scanned 31,000+ public skills, finding 7.4% contain security issues with 448 critical findings. Combines NLP-based markdown analysis with taint tracking.