How do I use SkillsSafe?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@SkillsSafe scan https://example.com/skill.md for threats" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

SkillsSafe

by GUCCI-atlasv

Overview Schema Source Related Servers Discussions Admin

TypeScript

Remote

SkillsSafe — AI Skill Security Scanner

Free, no-signup security scanner for AI agent skills. Scan any SKILL.md, MCP config, or system_prompt for threats before installing.

🌐 skillssafe.com

What Is SkillsSafe?

As AI agents become more powerful, malicious skills can steal credentials, exfiltrate data, or hijack your agent's behavior. SkillsSafe scans skill files before you install them — the same way an antivirus scans software before you run it.

Supported platforms: OpenClaw · Claude Code · Cursor · Codex · any MCP-compatible agent

Related MCP server: SkillsGuard

Features

🔍 Security Scanner

Paste content, enter a URL, or upload a file to scan for:

Threat	Description
Credential Theft	Attempts to access API keys, tokens, or passwords
Data Exfiltration	Skills that send your data to external servers
Prompt Injection	Hidden instructions that hijack agent behavior
Shell Injection	Reverse shell or arbitrary command execution
Zero-Width Characters	Invisible Unicode characters hiding malicious instructions
Scope Creep	Skills requesting permissions beyond their stated purpose
Memory Poisoning	Attempts to corrupt agent memory or context
Privacy Risk	Unnecessary access to personal or sensitive data

Each scan returns a risk score, severity rating (SAFE / CAUTION / DANGER / CRITICAL), and a shareable report link.

👁️ Zero-Width Character Detector

Visualize invisible Unicode characters (U+200B, U+200C, U+200D, U+FEFF, etc.) hidden inside text. Attackers embed these to create prompts that look safe to humans but carry hidden instructions for AI agents.

🔌 MCP Server Integration

Native Model Context Protocol support — let your agent automatically check skill safety before installation. No API key required.

# OpenClaw (one-line setup)
openclaw mcp add https://skillssafe.com/api/mcp

Available MCP tools:

scan_url — Scan a skill by URL
scan_content — Scan skill content directly
get_report — Retrieve a full scan report

📡 REST API

Works with any agent, script, or CI/CD pipeline.

# Scan by URL
curl -X POST https://skillssafe.com/api/v1/scan/url \
  -H "Content-Type: application/json" \
  -d '{"url": "https://clawhub.ai/skills/example"}'

# Scan by content
curl -X POST https://skillssafe.com/api/v1/scan/content \
  -H "Content-Type: application/json" \
  -d '{"content": "...skill content..."}'

Full OpenAPI spec: https://skillssafe.com/api/v1/openapi.json

Pages

Route	Description
`/`	Main security scanner
`/zero-width-detector`	Hidden Unicode character detector
`/api-docs`	Interactive API documentation
`/integrate`	Integration guide for MCP & REST API
`/feedback`	Bug reports and feature requests

Getting Started (Local Development)

npm install
npm run dev

Open http://localhost:3000 in your browser.

Environment Variables

# .env.local
# (see wrangler.toml for Cloudflare Workers configuration)

Tech Stack

Framework: Next.js (App Router)
Deployment: Cloudflare Workers via @opennextjs/cloudflare
Database: Cloudflare D1 (SQLite)
i18n: next-intl (English · 中文 · 日本語)

Pricing

100% Free · No Signup · No Rate Limits for Humans

API rate limit: 60 requests/hour (no API key required).

Feedback & Support

Found a bug or false positive? Send feedback or email support@skillssafe.com.

SkillsSafe is an independent security tool, not affiliated with Anthropic, OpenClaw, or Cisco.

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityInactive

ResponsivenessNo issues

Resources

GitHub Repository

Need Help?

Related Servers

Related MCP Connectors

SecurityScan A
net.apisecurityscan
Scan GitHub-hosted AI skills for vulnerabilities: prompt injection, malware, OWASP LLM Top 10.
Security Code Analysis Testing & QA Tools
82
MCP FortressOAuth
io.github.mcp-fortress
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
Security Testing & QA Tools Penetration Testing
2
skill-audit-mcp A
io.github.eltociear
Scan agent skills and MCP servers for malicious patterns before you load them
Security Penetration Testing
1116
TrustScan A
io.github.entradox
Security scanner for MCP servers and skills: Unicode injection, patterns, secrets.
Penetration Testing Code Analysis
41

Related MCP Servers

skillssafe-mcp
Security Testing & QA Tools Autonomous Agents
GUCCI-atlasv
A
license
Not graded
quality
D
maintenance
Free AI agent skill security scanner. Detects prompt injection, credential theft, zero-width character attacks, and ClawHavoc malware indicators. No signup required.
Updated 6 months ago (2026-03-12 10:07 UTC)
48 npm
1
MIT
SkillsGuard
Security Code Analysis
Teycir
F
license
Not graded
quality
D
maintenance
Static security scanner for AI agent skill packages that detects malicious SKILL.md files and bundled scripts before they run.
Updated 3 months ago (2026-06-21 00:58 UTC)
15
-
AgentVerus MCP Serverofficial
Security Code Analysis AI & Machine Learning
agentverus
A
license
Not graded
quality
D
maintenance
Security scanning for AI agent skills exposed as MCP tools, enabling skill analysis from ClawHub, GitHub, skills.sh, or raw URLs.
Updated 6 months ago (2026-03-16 01:14 UTC)
8 npm
MIT
guard-scanner
koatora20
A
license
Not graded
quality
C
maintenance
Provides a security scanner for AI agent skills and MCP servers, detecting threats like prompt injection, identity hijacking, and memory poisoning.
Updated 3 months ago (2026-06-22 22:46 UTC)
15 npm
2
MIT