---
title: "How to verify a skill or package before your AI agent installs it. Lazaretto"
description: "Autonomous agents install third-party skills, MCP servers, and npm packages on the fly. Here is how to check one for malicious behavior before it runs, with a free known-bad lookup and a deterministic scan."
url: "https://lazaretto.dev/blog/verify-a-skill-before-your-agent-installs-it"
---

[Home](https://lazaretto.dev/) / [Blog](https://lazaretto.dev/blog) / 2026-07-14

# How to verify a skill or package before your AI agent installs it

Autonomous agents install third-party skills, MCP servers, and npm packages on the fly. Here is how to check one for malicious behavior before it runs, with a free known-bad lookup and a deterministic scan.

AI agents increasingly install third-party skills, MCP servers, and npm packages without a human reviewing each one. That is a software supply chain, and it is actively targeted: public audits have found hundreds of malicious skills across registries: infostealers that harvest SSH keys, cloud credentials, browser profiles, and crypto wallets, often hidden behind fake “prerequisites” and `curl | bash` chains.

## The check that belongs before install

The missing step is a verification an agent can call on its own, right when it needs it. Two levels:

### 1. Free: is this content hash already known-bad?

```
curl -s https://lazaretto.dev/v1/known-bad/<sha256>
```

Exact-hash match against an indicator store refreshed daily from public threat feeds. A match is a hard stop. A non-match is *not* a verdict. It only means that exact hash is not on a known-bad list.

### 2. Full scan: deterministic behavioral analysis

```
curl -s -X POST https://lazaretto.dev/v1/scan \
  -H 'content-type: application/json' \
  -d '{"target":{"type":"npm_package","ref":"some-pkg@1.0.0"},"depth":"full"}'
```

The scanner fetches the artifact in a sandbox (it never runs it) and screens for credential access, exfiltration, obfuscation, prompt-injection payloads aimed at the reading agent, install-lifecycle droppers, and bundled secrets. There is no model in the serving path, so the result is deterministic and reproducible, and every finding carries the file, line, and sanitized snippet that triggered it.

## Bind the verdict to the bytes

A verdict is only meaningful against the exact artifact it was computed on. Every report is bound to a content hash, so after an install you can re-hash what actually landed on disk and confirm it matches what was scanned. If it differs, treat it as unscanned.

## Signals, not a warranty

A report describes what was detected and what is known; the decision to install remains yours. The `malicious` verdict is reserved for indicator-backed matches; behavioral heuristics reach `flagged`, always with evidence. See the [public rule catalog](https://lazaretto.dev/v1/rules) and the [OpenAPI contract](https://lazaretto.dev/openapi.json).

Lazaretto is the pre-install checkpoint agents call themselves. [Try it](https://lazaretto.dev/#try) · [pricing](https://lazaretto.dev/pricing) · [connect your agent](https://lazaretto.dev/agents).

---

Machine-readable index: https://lazaretto.dev/llms.txt. OpenAPI: https://lazaretto.dev/openapi.json. MCP endpoint: https://lazaretto.dev/mcp. Any page on this site is available as markdown by adding .md to its path.