Skip to main content
Glama
Sign In
agent-skill-audit-mcp

agent-skill-audit-mcp

by tylerscomic-lab
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Hybrid

Agent Skill & Config Security Audit

Security scanner for AI agent skills and config files (SKILL.md, CLAUDE.md, AGENTS.md, .mcp.json, settings.json). Finds hidden Unicode instructions, prompt injection, exfiltration commands and over-broad permissions before you install a skill.

Scan a skill before you install it

Agent skills and instruction files are read straight into your agent's context, and some ship scripts it can run. Research on public skill registries has found prompt injection and credential-stealing payloads in a large share of them. Installing a third-party skill is closer to adding a dependency than opening a document, and nothing scans them. This does.

Related MCP server: SkillsSafe

What it catches

  • Hidden Unicode instructions: invisible "tag" characters that render as blank but that models can read, plus zero-width and bidi control characters. The hidden message is decoded for you.

  • Prompt injection: "ignore previous instructions", "do not tell the user", fake system messages, approval bypasses.

  • Download-and-execute and obfuscation: curl | bash, base64-decode-and-run, large encoded blobs.

  • Exfiltration shapes: network commands that reference env vars or credential files, request-catcher and tunnel hosts, sensitive paths like ~/.ssh and .aws/credentials.

  • Over-broad permissions: unrestricted Bash in allowed-tools, Bash(*) pre-approvals, bypassed permissions.

  • Risky agent configs: unpinned @latest MCP servers, inline secrets, plaintext remote servers, hooks that make network calls, API base-URL overrides, auto-trusted project MCP servers.

Tools

  • audit_skill_file: scan SKILL.md, CLAUDE.md, AGENTS.md, .cursorrules or a bundled script.

  • audit_agent_config: audit .mcp.json or .claude/settings.json.

  • reveal_hidden_text: find and decode invisible characters in any text, and return a cleaned copy.

Static analysis only. Nothing in your input is executed or fetched. A clean result is not a guarantee, so read bundled scripts too.

Use it

Hosted on MCPize with a free tier (10 calls a day). Remote MCP endpoint (streamable HTTP, API key from MCPize):

https://agent-skill-audit-mcp.mcpize.run/mcp

Or run it yourself:

npm install
node server.js   # listens on :8080, MCP at /mcp

MIT licensed.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    This server cannot be deployed

    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    Resources

    Related MCP Connectors

    Related MCP Servers

    • SkillsGuard

      Teycir
      A
      license
      Not graded
      quality
      C
      maintenance
      Static security scanner for AI agent skill packages that detects malicious SKILL.md files and bundled scripts before they run.
      15
      MIT

    • SkillsSafe

      GUCCI-atlasv
      A
      license
      Not graded
      quality
      D
      maintenance
      Security scanner for AI agent skills, providing tools to scan skill files for threats such as credential theft and prompt injection.
      MIT

    • tar-engine

      qingxuantang
      A
      license
      Not graded
      quality
      C
      maintenance
      Audits AI agent skills for safety using static, semantic, adversarial, and supply-chain analysis, providing scores and risk flags. Can be run via CLI, CI, or as an MCP tool from Claude Code, Cursor, and Codex.
      2
      Apache 2.0

    • agent-sec-mcp

      sudo-ai-git
      A
      license
      Not graded
      quality
      C
      maintenance
      Enables authorized security auditing of AI-agent supply chains and agent-facing surfaces: deterministic local skill-bundle audits against eight attack patterns, secrets scanning, and scope-gated read-only recon of agent endpoints and MCP surfaces.
      MIT