Skillaudit

@megamind-0x

Repository Homepage

About Skillaudit

🛡️ Security scanner for AI agent skills — detect credential stealers, exfiltration, and malicious patterns before install

#security #scanning #ai-agents #mcp #vulnerability-detection

Basic information

Category

Developer Tools

Runtime

node

Transports

stdio

Publisher

megamind-0x

Submitted by

megamind-0x

Config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "skillaudit": {
      "command": "npx",
      "args": [
        "skillaudit"
      ]
    }
  }
}

Tools

No tools detected

We auto-extract tools from the README. The maintainer can list them under a ## Tools heading to populate this section.

Overview

What is Skillaudit?

Skillaudit is a security layer for AI agent skills that scans, gates, and enforces policy before an agent installs anything. It covers MCP and A2A protocols with 43 detection rules and 401 patterns, and has zero dependencies.

How to use Skillaudit?

Use the CLI via npx skillaudit (requires Node.js 18+) or call the HTTP API. For a quick gate check, run npx skillaudit gate <url> or curl to the /gate endpoint. Full scans, bulk checks, policy evaluation, and MCP server mode are also supported.

Key features of Skillaudit

43 detection rules across 16 security categories.
Pre-install gate check returning allow/deny decisions.
Bulk evaluation of multiple skills in one call.
Custom policy enforcement with risk thresholds.
MCP server mode for native tool integration.
Zero-dependency CLI, runs via npx.

Use cases of Skillaudit

Preventing credential theft from AI agent skills.
Scanning MCP manifests for schema poisoning.
Enforcing security policies in CI/CD pipelines.
Auditing npm/PyPI packages for malicious code.
Gate-checking skills before installation in agent workflows.

FAQ from Skillaudit

What runtime does Skillaudit require?

The CLI requires Node.js 18+; the hosted API needs no local runtime.

What is the rate limit for the API?

30 requests per minute per IP; you can bypass it with an API key.

How does Skillaudit avoid false positives?

Smart context suppression automatically filters out documentation examples and placeholder tokens.

Can I self-host Skillaudit?

Yes, clone the repository, run npm install && npm start, and it listens on http://localhost:3847.

What transports does Skillaudit support?

It supports CLI (stdio), HTTP API, and MCP protocol (stdio) via --mcp flag.

Comments

More Developer Tools MCP servers

test

A simple,high performance and secure live media server in pure Rust (RTMP[cluster]/RTSP/WebRTC[whip/whep]/HTTP-FLV/HLS).🦀

Grafana MCP server

MCP server for Grafana

Smithery CLI

Install, manage and develop MCP servers and skills for agents

OpenSumi

A framework helps you quickly build AI Native IDE products. MCP Client, supports Model Context Protocol (MCP) tools via MCP server.

MCP Unity Editor (Game Engine)

Model Context Protocol (MCP) plugin to connect with Unity Editor — designed for Cursor, Claude Code, Codex, Windsurf and other IDEs