MCP.so
ログイン
A

Agent Skill Scanner

@rexcoleman

リポジトリ

Agent Skill Scanner について

Scan OpenClaw SKILL.md and MCP tool definition files for security vulnerabilities. 22 rules across prompt injection, capability escalation, data exfiltration, encoded payloads, and composition risks. The only scanner targeting agent skill file formats.

#security#agent-security#prompt-injection#llm-security#skill-scanner

基本情報

カテゴリ

AI とエージェント

トランスポート

stdio

公開者

rexcoleman

投稿者

Rex Coleman

設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "agent-skill-scanner": {
      "command": "python3",
      "args": [
        "/path/to/agent-skill-scan-mcp/server.py"
      ],
      "env": {}
    }
  }
}

ツール

ツールは検出されませんでした

ツールは README から自動的に抽出されます。メンテナーは ## Tools という見出しの下に記載することで、このタブに反映できます。

概要

What is Agent Skill Scanner?

Agent Skill Scanner scans OpenClaw SKILL.md and Model Context Protocol (MCP) tool definition files for security vulnerabilities directly from Claude Code. It is for developers building agent skill files who need targeted security analysis beyond generic SAST tools.

How to use Agent Skill Scanner?

Install with pip install agent-skill-scanner, then configure in Claude Code's MCP settings by adding the agent-skill-scanner server pointing to the server.py script. Use the tools scan_skill_file (to scan a single file) or scan_directory (to recursively scan a directory) from within Claude.

Key features of Agent Skill Scanner

  • 22 detection rules across prompt injection, capability escalation, data exfiltration, encoded payloads, and composition risks.
  • Targets OpenClaw SKILL.md and MCP tool definition formats (missed by generic SAST tools).
  • Returns findings with severity, rule ID, description, and evidence.
  • Recursively scans directories for agent skill files.
  • Runs fully locally via stdio; no network calls after install.
  • Source is open and auditable on GitHub.

Use cases of Agent Skill Scanner

  • Scan a single agent skill file for vulnerabilities before deployment.
  • Recursively scan a directory of skill files to get aggregated findings.
  • Integrate into a CI pipeline using the companion GitHub Action.
  • Identify hidden attacks like system prompt override or shell spawning in skill files.

FAQ from Agent Skill Scanner

What does Agent Skill Scanner detect that other scanners miss?

It detects vulnerabilities in OpenClaw SKILL.md and MCP tool definitions – markdown-embedded code and YAML skill configurations that generic SAST tools (semgrep, CodeQL) completely miss.

What are the runtime requirements for Agent Skill Scanner?

Python 3.10 or newer and the scanner engine installed via pip. No external services or network connections are required after the initial installation.

Where does Agent Skill Scanner store or send data?

All scanning is done locally via stdio. There is no data collection, telemetry, or outbound network calls beyond the initial pip install.

What are the limitations of Agent Skill Scanner?

It uses pattern-based detection only (no semantic analysis). It is designed specifically for OpenClaw SKILL.md and MCP tool definitions, and its rules cover known attack patterns from published research, not zero-days.

What transport does Agent Skill Scanner use for MCP?

It uses stdio transport to communicate with Claude Code. No HTTP or network transport is involved.

コメント

「AI とエージェント」の他のコンテンツ

Unreal Engine Generative AI Support Plugin

prajwalshettydev

Unreal Engine plugin for LLM/GenAI models & MCP UE5 server. OpenAI GPT-5, Deepseek R1, Claude Opus/Sonnet, Gemini 3, Grok 4, Alibaba Qwen, Kimi, ElevenLabs TTS, Inworld, OpenRouter, Groq, GLM, Ollama, Local, Meshy, Tripo, Hunyuan3D, Rodin, fal, Dashscope, Seedream. NPC AI, agenti

622

MCP-LLM Bridge

patruff

Bridge between Ollama and MCP servers, enabling local LLMs to use Model Context Protocol tools

976

1MCP - One MCP Server for All

1mcp-app

A unified Model Context Protocol server implementation that aggregates multiple MCP servers into one.

468

21st.dev Magic AI Agent

21st-dev

It's like v0 but in your Cursor/WindSurf/Cline. 21st dev Magic MCP server for working with your frontend like Magic

5.3K

欢迎来到 智言平台

Shy2593666979

AgentChat 是一个基于 LLM 的智能体交流平台，内置默认 Agent 并支持用户自定义 Agent。通过多轮对话和任务协作，Agent 可以理解并协助完成复杂任务。项目集成 LangChain、Function Call、MCP 协议、RAG、Memory、HITL、Skill、Milvus 和 ElasticSearch 等技术，实现高效的知识检索与工具调用，使用 FastAPI 构建高性能后端服务。

797