dogana

dogana decides what gets into a coding agent. Python 3, standard library only, GPL-3.0.

Why a skill is not a library

A library you call when you want it. A skill is read by the agent and followed. So the risk is not a bug hidden in the code: it is the text itself, which by construction tells the agent what to do.

That makes a skill a prompt injection you authorised. Installing five of them found in a post means handing an agent with write access to your repositories a set of instructions written by strangers.

Three commands

dogana ispeziona ~/downloaded/design-review      # look and report, touch nothing
dogana quarantena ~/downloaded/design-review -o ~/.claude/skills
dogana fidati ~/.claude/skills/my-skill          # "I read this one", with its fingerprint
dogana tutte ~/.claude/skills                    # the round on all of them

What it looks at

Anything executable: .py, .sh, .js, binaries, files with a shebang. None of it survives into the fork.

Powers granted in the frontmatter. A skill that gives itself allowed-tools, hooks or mcp is asking for capability, not describing a task.

Orders in the prose. Not keywords, but verb plus object: read ~/.ssh/id_rsa fires, no API key does not. It separates “do not tell the user” from “do not ask the user to pick a font”. Inside code fences and backticks the same line weighs less, because that is usually an example.

Characters that do not show: zero width, bidirectional controls, Cyrillic letters shaped like Latin ones.

The detector is measured, not asserted

python3 prove.py runs it over thirty lines judged by hand, fifteen dangerous and fifteen harmless. Half the harmless ones are real lines from installed skills that a naive first version rejected: it searched for words, and flagged no API key as a request for secrets and a skill that merely describes launchd as one trying to persist. Eight skills out of ten failed, which is a tool nobody keeps.

The lesson generalises: a security detector that always shouts gets turned off, so precision counts as much as recall, and both have to be measured against known-good cases.

Quarantine

quarantena writes a knowledge-only fork: scripts gone, frontmatter rewritten from scratch with just a name and a description, URLs downgraded to citations, invisible characters stripped, and a header at the top declaring the content reference material rather than orders. Beside it sits PROVENIENZA.md: where it came from, the fingerprint of the original, what was removed, and the findings that still stand as a warning.

The trust ledger

fidati records that you read that skill, saving its fingerprint. It is not a permanent pass: on the next inspection dogana says whether it has changed since. That is the part that protects, because a skill can be clean today and hostile after a quiet update.

What it does not do

It does not make text harmless. The model still reads it, and persuasive text stays persuasive. dogana removes the machinery (execution, network, persistence) and raises the cost of an attack. It does not remove it. Reading is still yours.

Source