Evolfe Lab / Checker
Is that agent file safe to load?
AI agents follow instruction files – CLAUDE.md, SKILL.md, AGENTS.md – the way computers follow code. A third of publicly shared agent skills were found to carry security flaws.
About to install a skill? Check the link first.
Paste a GitHub link to a SKILL.md, CLAUDE.md or rule file – we fetch it and check it before it ever touches your machine.
Your browser fetches the file straight from GitHub – it never passes through us.
Drop your CLAUDE.md, SKILL.md or AGENTS.md files here
or click to choose them – .md and .txt, up to 50 at a time
Files are read in your browser. Nothing is uploaded, nothing is stored – close the tab and it’s gone.
Under the bonnet
What it checks
- Invisible instructions
- Unicode tag and direction-override characters – text an AI reads but you can't see.
- Download-and-run commands
- Instructions that fetch something from the internet and execute it in one step.
- Hidden or encoded commands
- Base64 blobs and encoded PowerShell – decoded on the spot and re-checked, so you see what they actually say.
- Data sent out
- Uploads to webhook collectors, paste sites and other known exfiltration endpoints.
- Secrets in reach
- Lines that touch stored credentials or keys, flagged harder when the network is on the same line.
- Covert behaviour
- Phrases like 'don't tell the user' – and instructions that copy themselves into your other agent files.
What it can’t tell you
This is a red-flag check, not an antivirus. It matches the attack patterns documented by security researchers – it cannot catch a novel technique, judge intent, or see malware already running on a machine. “No known red flags” means exactly that, and nothing more. The wider story – fake AI installers, stolen browser sessions, poisoned skills – is in our article on malware dressed as AI tools.
Want the whole environment checked, not just the files?
Where your AI tools came from, what extensions your team installed, whether the agent setup is clean – that audit is how our AI implementation work usually starts.
Book an AI Audit