ShieldAPI MCP

scan_skill

Read-onlyIdempotent

Scan an AI agent skill/plugin for security issues across 8 risk categories (Snyk ToxicSkills taxonomy). Checks for prompt injection, malicious code, suspicious downloads, credential handling, secret detection, third-party content, unverifiable dependencies, and financial access patterns. Static analysis only — no code execution. Returns risk score (0-100), severity-ranked findings with file locations, and human-readable summary.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "scan_skill"
  }
}

Input Schema

Name	Required	Description	Default
`files`	No	Additional code files to analyze (max 20 files)
`skill`	No	Raw SKILL.md content or skill name from ClawHub

Schema Changelog

Changes observed during successful MCP inspections.

AddedOct 30, 2026

TDQS

A4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds real context beyond the annotations: 'static analysis only — no code execution' is a meaningful safety guarantee, and the description discloses the return shape (0-100 risk score, severity-ranked findings with file locations, summary). With readOnlyHint/idempotent already covering the safety profile, this is strong but omits limits such as file size or rate constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four tight sentences: purpose and taxonomy first, category enumeration second, safety caveat third, return values last. Every sentence carries distinct information with no repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description does the work of explaining return values, and it discloses the non-execution behavior and full category list. Minor gaps remain around how the 'skill' name lookup against ClawHub resolves and any size limits, but nothing essential for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and both parameters (files, skill) are documented there, including the 20-file cap and the ClawHub name option. The description adds nothing about parameters, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Scan an AI agent skill/plugin') and immediately scopes it with the 8 risk categories and the Snyk ToxicSkills taxonomy reference. This clearly separates it from sibling tools that check domains, emails, IPs, URLs, or passwords.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The object of the scan is clear (agent skills/plugins), so usage is implied, but the description never says when to prefer this over siblings like full_scan or check_prompt, nor any prerequisites or exclusions. An agent must infer the routing decision itself.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All ShieldAPI MCP tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?