skillvet is a one-command supply-chain scanner for AI agent skills and MCP servers. It reads the tree without executing it and prints a RED / YELLOW / GREEN verdict in about five seconds. Node 20+, zero runtime dependencies. Flags undeclared outbound hosts, ~/.ssh and token reads, npm postinstall hooks, base64/eval-style obfuscation, and unexpected binaries. MIT license.
