A new attack surface your current stack cannot see.

AWS keys, database URIs, OAuth tokens, .env file contents, API keys - pasted into a chat and never committed to git. Invisible to your secret scanners. Obvious to Skarn.

Skarn maps the full attack chain: poisoned content drives a credential read, the assistant exfiltrates. Findings are mapped against MITRE ATLAS techniques and the OWASP Top 10 for LLM Applications 2025, and the chain is correlated across ATLAS tactic-aligned stages. Not just the secret - the mechanism.

Base64-encoded payloads piped to curl, wget, or netcat through agentic tool calls - the class of exfiltration that looks like normal developer activity until the pattern is surfaced.

Single binary, on-premise only. macOS, Windows, Linux (Intel + ARM). No cloud dependency, no vendor dashboard enrolment, no persistent agent required.

SARIF and JSON for SIEM integration. Risk scores per session and per team. CI/CD gate support for policy enforcement at the pipeline level.

Every finding is crosswalked against MITRE ATLAS, the OWASP Top 10 for LLM Applications 2025, and CWE, emitted as SARIF 2.1.0 taxonomies and mirrored to result tags. Findings land in your SIEM and ASPM in a standard vocabulary your team already triages against, not a vendor-specific one. See the standards crosswalk.

A pre-execution hook (Claude Code, Cursor, Codex CLI, and GitHub Copilot) intercepts and blocks malicious tool calls before execution - a hardcoded credential, a typosquatted package - without interrupting the developer.

All credentials masked in reports. Raw values never appear in output, enforced by a gate. Each finding attributed to the exact session and message.

Requires assessing the effectiveness of cybersecurity risk-management measures, including software-development security. Skarn provides documented, SARIF-format evidence of AI-session scanning - the auditable artifact supervisory authorities expect. Management-body members are accountable under Article 20.

Requires financial entities to identify ICT vulnerabilities. Credential exposure through AI development tools is a direct ICT risk. The management body owns the framework under Article 5. Applicable since 17 January 2025, supervised by BaFin for German entities.

From 2 August 2026, high-risk AI systems must technically allow the automatic recording of events over their lifetime. Skarn is not an AI system under the Act, so it is not in scope itself. Where you must show that AI activity is monitored, --audit-log (Team) appends a hash-chained record of each scan - timestamp, policy, finding counts, verdict, no secrets - and detects in-place edits and reordering of that history.

In force since 17 March 2026 for the physical resilience of critical installations; the cyber duties for the same operators sit in NIS-2 and the BSIG. Operators registering with the BBK by 17 July 2026 document their technical, security-related, and organisational measures - and AI-session exposure is now part of that picture. Skarn produces the evidence locally, with nothing leaving your machines.

Both assess cloud services: C5 through an auditor's attestation, the Commission's framework (2025-10-20) through a sovereignty score on data localisation, operational control, and legal jurisdiction. Skarn ships no cloud service, so neither applies to it and no vendor cloud enters your assessment scope.