Privacy policy

Effective October 27, 2026

Skill Scanner checks AI agent skills (SKILL.md packages, their scripts and MCP tool definitions) that you choose, and explains whether they are safe to install. This policy covers the Skill Scanner Chrome extension and this website.

In short

Skill Scanner is two separate things: the Chrome extension you install, and this website (skillscanner.web.app). They follow different rules, so here they are apart.

The Chrome extension

Tracks nothing. No analytics, accounts, ads or cookies, and we have no server, so nothing you do in it reaches us.
Skills you check are analyzed on your device, and only leave it if you ask for an AI review with your own key.
It can only contact the services listed below, and only when you take the action described. The browser enforces this list.
You can see every request it makes ("Where your data goes"), and turn them all off with Offline mode.

This website

Counts visits and a few clicks, like starting the game or going on to the Chrome Web Store, with Umami. No cookies, and it can't tell who you are.
Skills you paste into the checker on this page are analyzed in the page and never sent anywhere.
This counting is for the website only. Nothing you do in the extension is ever counted.

The only personal information we receive, from either one, is a message you choose to send us.

The Chrome extension

This part is only about the extension you install in Chrome. It has no analytics.

What is processed on your device

Skill text and files you paste, upload, select on a page, or download from a GitHub link or a ClawHub install command are analyzed inside the extension. They are kept in memory while you look at the result and are not uploaded anywhere, except to an AI provider if you explicitly ask for an AI review (see below).

Network requests (complete list)

ServiceWhenWhat is sent

GitHub (api.github.com, raw.githubusercontent.com, gist.githubusercontent.com)When you check a GitHub link or page, or once a day for skills you chose to watchThe address of the repository, folder or file. If you added a GitHub token in Settings, it is sent to api.github.com only.

ClawHub (clawhub.ai), OpenClaw's skill registryWhen you check an install command that points to ClawHub ("openclaw skills install …" or "clawhub install …")The skill's name, and its owner and version if the command has them.

OSV.dev (api.osv.dev), Google's open vulnerability databaseWhen "check software packages" is on and the skill lists dependenciesPackage names and versions only (for example "requests 2.19.0").

Your chosen AI provider: Anthropic (api.anthropic.com), OpenAI (api.openai.com), Google Gemini (generativelanguage.googleapis.com) or OpenRouter (openrouter.ai)Only if you add your own API key, press "Ask AI", and then press "Send" on a confirmation screen that shows the exact contentThe skill's files (with detected secrets replaced by [REDACTED]) and the scanner's findings, plus your API key so the provider can bill you. That provider's own privacy policy applies.

Ollama on your own computer (localhost:11434)Only if you choose OllamaThe same as above, to the program on your computer. Nothing goes to the internet.

No other address can be contacted: the extension's code refuses it, and the browser's Content-Security-Policy blocks it. API keys and tokens are never written to the in-app activity log.

Links you choose to open

Some buttons open another website in a new tab, with text you can read and edit there before doing anything: "Tell the author" opens GitHub's own new-issue page for the skill, pre-filled with the findings; "Recommend Skill Scanner" opens WhatsApp, X, LinkedIn or your email app with a short message and a link to the extension; the quick guide's "Try it on a real skill" opens an example skill on GitHub. The extension itself sends nothing in these cases. What happens on those websites is covered by their own privacy policies.

What is stored, and where

Everything is stored on your device only, in Chrome's storage for the extension, which websites and other extensions can't read:

your settings;
your AI API key and GitHub token, only if you choose "remember". With "remember" off, they are kept in memory only (Chrome's session storage): never written to disk, erased when Chrome closes;
your recent scan reports (to reopen them in "My skills"), unless you turn history off;
a fingerprint of each skill you checked (SHA-256 hashes of its files, no content), to warn you if it changes later;
simple local counters (how many skills you checked, how many looked safe or risky);
a log of background re-checks of skills you chose to watch.

"Erase my data" in Settings → Privacy & data deletes all of it. Uninstalling the extension deletes it too.

Chrome permissions

storage: the local data listed above.
activeTab: when you click the toolbar icon, read the address of that tab to offer a one-click check on GitHub skill pages.
contextMenus: the right-click "Check with Skill Scanner" entries.
scripting: when you use "Check selected text", read the text you selected in that tab.
alarms: re-check skills you chose to watch, once a day.

The extension requests no host permissions and cannot read pages you browse on its own.

This website

This part is only about skillscanner.web.app, the site you're reading. None of it applies to the extension.

This website has no cookies or ads, and loads its fonts, images and scripts from itself. To know how many people visit, play the game, check a skill or go on to the Chrome Web Store, it counts those visits and clicks with Umami Cloud (umami.is), with the data kept in the EU. Umami uses no cookies, doesn't keep your IP address and can't tell who you are. If your browser sends "Do Not Track", nothing is counted.

Like any website, it is delivered by a hosting service: Firebase Hosting (Google), which receives your IP address and browser details to send you the pages. We don't receive or keep those logs.

Network requests (complete list)

ServiceWhenWhat is sent

GitHub, ClawHub and OSV.devWhen you check a link or install command in the scanner on this pageThe same as in the extension (see the list above). Pasted text and uploaded files are checked inside the page and not sent anywhere.

YouTube (youtube-nocookie.com, YouTube's privacy-enhanced mode)Only after you press play on the videoWhat any embedded YouTube video receives, such as your IP address and browser details. Until you press play, the page shows a local picture and contacts nothing. YouTube's own privacy policy applies.

Umami Cloud (gateway.umami.is), a visitor counter that uses no cookiesWhen a page opens, and when you start the game, check a skill, play the video, share the site or open the Chrome Web Store pageThe page address, the site that sent you here, your screen size and language, and the event's name with one plain detail: which button or part of the page (for example "store_click, hero"), the level you reached in the game, the kind of check (a link, pasted text or an example), or which share button you used. Never what you paste, type or upload. Umami works out your browser, device and country from the request, doesn't keep your IP address, and stores the counts in the EU.

The site is registered with Google Search Console, which shows us totals for how people find it in Google Search. That uses only what Google Search already knows, and adds nothing that runs on this page.

The share buttons are plain links to each network's own share page. Nothing loads from WhatsApp, LinkedIn, X, Facebook or Reddit unless you click one.

The page's Content-Security-Policy blocks every other address.

What is stored in your browser

The game in the first section remembers your best score and whether sound is on, in your browser's local storage. They are never sent anywhere, and clearing this site's data in your browser deletes them. The scanner on this page stores nothing, and neither does the visitor counter.

Messages you send us

If you email us, we receive your email address and what you write. We use them only to reply to you, and we don't share them or add you to any list. Our inbox is Gmail (skillscanner.app@gmail.com). To have a message deleted, ask us at the same address.

Children

Skill Scanner is not directed at children and collects no personal data.

Changes

Updates to this policy are published on this page with a new effective date.

Contact

Email skillscanner.app@gmail.com, or use the Support tab on Skill Scanner's page in the Chrome Web Store.