Immune Check — a pre-flight reflex that scans any outbound artifact for secrets/PII before it leaves the body. Stack-agnostic. The defense organ alongside octopus + rem-sleep.
SaferSkills independently audited immune-check (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A boundary defense. Before any artifact crosses out of the body — into a public repo, an external service, a release, someone else's inbox — this is the reflex that scans it for foreign or dangerous material, so an infection never spreads in the first place. It is far cheaper to never leak than to scrub a leak after the fact.
This is the immune organ of an agent's nervous system: it distinguishes self (safe to expose) from non-self (must not cross the membrane), responds proportionally, and remembers every antigen so the next scan is faster.
Any moment an artifact leaves your control and becomes hard to recall:
If it can be un-done with a local edit, it's still inside the body — no scan needed. If recalling it means asking someone else to forget, scan first.
The scan adapts to whatever you have. Detect a scanner in this order and use the first available; if none, fall back to the built-in pattern pass:
argus on PATH (the reference organ this skill was modeled on).gitleaks detect/gitleaks dir.trufflehog filesystem/git.detect-secrets scan.git secrets --scan.Report which scanner ran, so the user knows the depth of coverage.
State, in one line: what is about to leave and to where. "Making ~/Foo public on GitHub." "Pushing 3 commits to an upstream fork." "Sending report.json to a Slack channel." The destination sets the stakes — a public repo is maximal, an internal push is lower. Confirm the membrane before scanning.
Run the detected scanner over exactly what crosses — the diff being pushed, the files being published, the payload being sent (not the whole working tree if only part leaves). The antigen classes, whatever the tool:
-----BEGIN ... PRIVATE KEY-----), .env contents, cloud credentials, connection strings with passwords.node_modules, build artifacts, large binaries, committed dependency trees that bloat and may carry their own secrets.Classify every finding — overreaction is also a failure mode; an immune system that blocks everything kills the host:
For pathogens:
git filter-repo) or, if already pushed/public, treat the secret as compromised.Every real encounter should make the next scan smarter. After triage:
feedback memory if you keep one): what leaked, how it nearly crossed, what now guards it. This is the antibody.Report a verdict:
file:line), and the exact remediation. The outbound action must not proceed until resolved.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.