Every skill costs you, every session
An installed skill's name and description load into context at startup whether you use it or not. Many skills means thousands of tokens per session, and similar descriptions competing to trigger.
★ open-source · claude code skill + cli · MIT
Treat agent skills as temporary capabilities, not permanent installations.
Skills should be rented, not owned: use it, finish the task, throw it away. Skill Airlock finds skills in a local index, audits them in quarantine before they touch your machine, asks you, uses them, and lets them go when the job is done.
v0.1.2 · released 30 October 2026 · MIT-licensed · Python 3 + git, nothing else
▶ see it in action
~/.ssh to an outside server. That skill is an inert test fixture from the repo. The PDF skill was used once, both tables came out, and nothing was installed.
// the problem
Find it, install it,
Find it, install it,
forget it
Code from strangers, with your permissions
A skill is instructions and scripts your agent runs as you, next to your .env, SSH keys and production config. Skills can also change after you install them.
Your task leaks
Searching for a skill online sends your query, which is usually a description of your work, to a third party.
// how it works
Five steps,
Five steps,
you decide in the middle
find→inspect→decide→use→vent
| Step | What happens |
|---|---|
| find | airlock sync mirrors the sources you choose. airlock find searches the local index offline. The query is never stored or sent. |
| inspect | Copies the skill into quarantine, outside every agent's skills directory, records a sha256 for every file, and runs the audit. If the copy changes after the audit, the skill is neither used nor installed. |
| decide | The agent shows you the findings with file:line evidence. On BLOCK it advises against the skill and goes ahead only on your explicit decision. |
| use | Once, temporary or kept: see the modes below. |
| vent | airlock vent removes only what Airlock installed itself. It never overwrites or removes anyone else's skills. |
Commands: sync find inspect audit use dock vent list verify budget
// what the audit checks
Scripts and Markdown,
Scripts and Markdown,
because Markdown is instructions
A skill's Markdown is what your agent acts on, so the static rules read every file. Each finding has a severity, file:line and a sanitised excerpt.
| Group | Looks for |
|---|---|
| Network | tools and code that reach the network |
| Secrets | paths to ~/.ssh, ~/.aws, .env, keychains, browser cookies |
| Exfiltration | secrets plus network in one command, one script, or split across several scripts |
| Execution | download-and-run and decode-and-run |
| Persistence | crontab, systemd/launchd, shell startup files, the agent's own settings, hooks and MCP config, authorized_keys |
| Destruction | commands that wipe files or devices |
| Prompt injection | including claims that you already approved the skill, and instructions to run Airlock with --force |
| Hidden content | zero-width characters, bidi controls, Unicode tag characters (decoded and shown), instructions in HTML comments |
| Declared vs actual | scripts that do what the description never mentions |
| Hygiene | invalid names, symlinks out of the skill, binaries, oversized SKILL.md |
Severity depends on context. SKILL.md counts in full. Prose in other Markdown files and code comments count one level lower. Behaviour the description declares counts one level lower, but only for a narrow vocabulary. Nothing excuses secrets plus network. find never prints text aimed at the agent: such a description, or an invalid name, is withheld with a pointer to inspect.
CLEAN
no findings
OK
minor notes only
REVIEW
read the findings before deciding
BLOCK
the agent advises against it; proceeds only on your explicit decision
// modes
Rent it for as long
Rent it for as long
as you need it
once
Nothing is installed. The agent reads the skill from quarantine for this task only.
temp
Installed with an expiry date and cleaned up automatically at session start.
keep
Installed and pinned to a specific commit. lock.json and airlock verify detect changes to installed files.
// context budget
See what your skills
See what your skills
cost you
airlock budget shows the token cost per session, the skills you haven't used in 30 days (from your local Claude Code transcripts, nothing is stored), and descriptions that overlap.
$ airlock budget
skill agent tok/session on use last used airlock
docx claude 210 1,486 >30d keep
pdf claude 110 1,878 >30d temp → 2026-11-06
# Not used in the last 30 days (from local transcripts): docx, pdf
# → airlock vent docx pdf
// calibrated in public
What worked,
What worked,
and what didn't
The rules were tuned against 62 skills from three public catalogs, then put through an independent review. Here is the whole history, including the misses.
- First rule set: 18 BLOCK. Mostly documentation that describes attacks, flagged as if it performed them.
- v0.1.0: 0 BLOCK, 16 REVIEW, 46 CLEAN/OK. Context-aware severity separated describing from doing.
- An independent review found 3 bypasses:
curl | bashinSKILL.mdprose,~/.sshtheft split across two scripts, and instructions to the agent hidden in thenamefield. - v0.1.1: all three fixed, each one now a test. 1 BLOCK, 21 REVIEW, 40 CLEAN/OK. The one BLOCK is an official skill whose
SKILL.mdtells the agent to run the Homebrew installer withcurl | bash: blocked on purpose, and yours to override after reading it. - The same review on installed skills found 2 false blocks:
toast.promiseread as a collection domain, and a zero-width character used in a template before a code fence. - v0.1.2: both fixed. Calibration numbers unchanged. All 7 malicious test skills are blocked. 26 automated tests.
// privacy
Your query
Your query
stays on your machine
Search is local
Search runs in a local index of sources you choose. The query is never written or sent, and a test checks it.
No telemetry
No telemetry, no accounts, no server. The only network traffic is airlock sync fetching the sources you listed.
Your sources
By default three public skill catalogs (62 skills). Add your own git repos, company ones included, or local directories.
Works with Claude Code and the shared ~/.agents/skills directory used by other agents. More agents are planned.
// honest limits
What it is not
Not a proof of security
The audit is a static filter. It surfaces evidence for you to judge. A clean report means nothing known was found.
Not a sandbox
A skill used in once mode still runs with your agent's permissions. The audit is there so that you decide before it does. A sandbox for scripts is on the roadmap for v0.3.
Not a marketplace
It indexes the sources you choose. There is nothing to sign up for and nothing is hosted.
Next: v0.2 adds airlock update with a diff and new findings, trust lists and profiles. v0.3 adds local ratings (optionally in Project Brain), a sandbox for scripts and more agents.
// install
Three commands
Requires Python 3 and git. Nothing else.
git clone https://github.com/OoneBreath/skill-airlock.git
cd skill-airlock && ./install.sh
airlock sync
One remembers,
the other keeps the toolbox lean
Skill Airlock is the sister project of Project Brain, the open-source memory for Claude Code. Brain remembers your projects across sessions; Airlock rents skills only for as long as a task needs them.
Meet Project Brain →