广告合作
MCP.so
登录
A

Agent Skill Scanner MCP Server

@rexcoleman

代码仓库

基本信息

分类

AI 与智能体

传输方式

stdio

作者

rexcoleman

提交者

Rex Coleman

关于 Agent Skill Scanner MCP Server

Scan OpenClaw SKILL.md and MCP tool definition files for security vulnerabilities. 22 rules across prompt injection, capability escalation, data exfiltration, encoded payloads, and composition risks. The only scanner targeting agent skill file formats.

#security#agent-security#prompt-injection#llm-security#skill-scanner

Agent Skill Scanner MCP Server 配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "agent-skill-scanner": {
      "command": "python3",
      "args": [
        "/path/to/agent-skill-scan-mcp/server.py"
      ],
      "env": {}
    }
  }
}

Agent Skill Scanner MCP Server 工具

工具列表暂未提供

当前收录暂时没有可展示的工具列表，不代表服务没有工具。请查阅项目文档了解支持的能力。

工具是从 README 中自动提取的。维护者可以在 ## Tools 标题下列出工具,即可填充这部分内容。

概览

What is Agent Skill Scanner?

Agent Skill Scanner scans OpenClaw SKILL.md and Model Context Protocol (MCP) tool definition files for security vulnerabilities directly from Claude Code. It is for developers building agent skill files who need targeted security analysis beyond generic SAST tools.

How to use Agent Skill Scanner?

Install with pip install agent-skill-scanner, then configure in Claude Code's MCP settings by adding the agent-skill-scanner server pointing to the server.py script. Use the tools scan_skill_file (to scan a single file) or scan_directory (to recursively scan a directory) from within Claude.

Key features of Agent Skill Scanner

  • 22 detection rules across prompt injection, capability escalation, data exfiltration, encoded payloads, and composition risks.
  • Targets OpenClaw SKILL.md and MCP tool definition formats (missed by generic SAST tools).
  • Returns findings with severity, rule ID, description, and evidence.
  • Recursively scans directories for agent skill files.
  • Runs fully locally via stdio; no network calls after install.
  • Source is open and auditable on GitHub.

Use cases of Agent Skill Scanner

  • Scan a single agent skill file for vulnerabilities before deployment.
  • Recursively scan a directory of skill files to get aggregated findings.
  • Integrate into a CI pipeline using the companion GitHub Action.
  • Identify hidden attacks like system prompt override or shell spawning in skill files.

常见问题

1

What does Agent Skill Scanner detect that other scanners miss?

It detects vulnerabilities in OpenClaw SKILL.md and MCP tool definitions – markdown-embedded code and YAML skill configurations that generic SAST tools (semgrep, CodeQL) completely miss.

2

What are the runtime requirements for Agent Skill Scanner?

Python 3.10 or newer and the scanner engine installed via pip. No external services or network connections are required after the initial installation.

3

Where does Agent Skill Scanner store or send data?

All scanning is done locally via stdio. There is no data collection, telemetry, or outbound network calls beyond the initial `pip install`.

4

What are the limitations of Agent Skill Scanner?

It uses pattern-based detection only (no semantic analysis). It is designed specifically for OpenClaw SKILL.md and MCP tool definitions, and its rules cover known attack patterns from published research, not zero-days.

5

What transport does Agent Skill Scanner use for MCP?

It uses stdio transport to communicate with Claude Code. No HTTP or network transport is involved.

评论

AI 与智能体 分类下的更多 MCP 服务器

OpenZiti / LLM-Gateway

openziti

NetFoundry LLM Gateway is an OpenAI-compatible API proxy that routes requests across multiple LLM providers using zero-trust networking. Zero trust LLM gateway. OpenAI-compatible proxy with semantic routing and load bala

93

botchelor

David Smith

Docs: https://botchelor.com/agents and https://botchelor.com/llms.txt . Botchelor is a blind-date show for fictional characters, and AI agents are welcome to play. Over MCP, your agent builds an original character in w

CrawlForge MCP Server

mysleekdesigns

28-tool MCP server for web scraping, crawling, deep research & autonomous extraction — clean Markdown & structured JSON for Claude, Cursor & any MCP client. 1,000 free one-time credits, local-Ollama LLM support.

2

scvd.store

seancrecord

scvd.store is an evidence observatory for agentic commerce. Independent signed observation of what other people's endpoints, artifacts and payments actually did among other things. USDC on Base, Arbitrum One, World Chain

2

GetIntel

tarang8811

Public docs + tool manifest for the GetIntel MCP connector (app.getintel.ai)

广告合作