---
title: "Pre-execution skill content scan"
method: POST
path: "/v1/scan/skill"
---

# Pre-execution skill content scan

`POST /v1/scan/skill`

## Request

- Base URL: `https://nullcone.ai/api`
- URL: `https://nullcone.ai/api/v1/scan/skill`
- Auth: none declared

Scans a skill/instruction file for malicious patterns BEFORE execution. Detects download-and-execute chains, bootstrap poisoning (.npmrc injection), encrypted credential exfiltration, and multi-stage kill chains. If should_block is true, the skill should NOT be executed.

## Request body

- SkillScanRequest
  - `content` string, required: Full text content of the skill file to scan
  - `source_url` string: URL where the skill was fetched from

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/nullcone/apis/nullcone-api.md) · [All operations](https://skmtc.dev/nullcone/apis/nullcone-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nullcone/apis/nullcone-api/revisions/c00983c87271?raw)