About Leelaloo/Cardea
Cardea reads a skill the way an attacker would: as files sitting on your disk. Point it at a folder and it runs 80+ checks: 40 prompt-injection and obfuscation patterns (English and multilingual, normalized against homoglyph/zero-width tricks), 18 hidden-unicode detectors, structure and spec validation, dead-reference and runtime-breakage checks, plus orchestration of bandit/semgrep/shellcheck/gitleaks/pip-audit when installed, then hands you a 0-100 score, a findings list with file and line for everything, and if anything critical turns up, a DO NOT INSTALL verdict that no amount of good structure can talk its way out of.