Razin - Static analysis for LLM agent skills

Razin is a local scanner for SKILL.md-defined agent skills. It performs static analysis only (no execution) and writes deterministic findings. An optional sandbox-artifact workflow seals an approval-bound plan and simulates verification without running skill code.

Table of contents

• Documentation
• Requirements
• Install
• Quick start
  • Common CI gates
  • Output formats
• Local development
• Where to read more
• Contributing
• Security
• License

Documentation

Full documentation lives at:

• https://theinfosecguy.github.io/razin/

Canonical docs source in this repository:

• docs/

Use this README for quick start only.

Requirements

• Python 3.12+

Install

With Homebrew (current, via tap):

brew tap theinfosecguy/homebrew-tap
brew install razin
razin --help

With PyPI:

pip install razin
razin --help

Quick start

Run a scan:

razin scan -r . -o output/

Validate config:

razin validate-config -r .

Common CI gates

# Fail if any high-severity finding exists
razin scan -r . --fail-on high --no-stdout

# Fail if non-probabilistic review priority is 70 or above
razin scan -r . --fail-on-score 70 --no-stdout

Output formats

# Default per-skill JSON reports
razin scan -r . -o output/ --output-format json

# Add CSV + SARIF exports
razin scan -r . -o output/ --output-format json,csv,sarif

Local development

uv sync --dev
uv run pytest -q
uv run ruff check src tests
uv run mypy src tests

Docs preview and checks:

uv sync --group docs
uv run mkdocs serve
uv run mkdocs build --strict
uv run mdformat --check README.md docs

Where to read more

• Getting started
• CLI reference
• Configuration
• Detectors
• Output formats
• Sandbox verification artifacts
• Docker workflow
• CI and exit codes
• Troubleshooting

Contributing

See CONTRIBUTING.md.

Security

See SECURITY.md.

License

MIT