{"name":"ai.skilltotal/skilltotal","slug":"skilltotal","title":"SkillTotal","description":"Deterministic security scan of MCP servers, agent skills and npm/PyPI packages. Runs locally.","url":"https://mcp.market/server/skilltotal","rating":null,"grade":"B","score":75,"certified":false,"status":"active","category":"ai","tags":["ai","security"],"presence":{"score":39,"stars":3,"forks":0,"downloads_week":1395,"last_push_at":"2026-09-19T17:30:13.000Z","license":"Apache-2.0"},"uptime":null,"claimed":false,"transport":"pypi","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/pezhik/skilltotal","website":"https://www.skilltotal.ai","version":"0.49.0","remotes":[],"packages":[{"registryType":"pypi","identifier":"skilltotal","version":"0.49.0","transport":{"type":"stdio"},"packageArguments":[{"description":"Run the CLI as an MCP server on stdio.","isRequired":true,"value":"mcp","type":"positional"}]}],"tools":[{"name":"_ensure_agent_facing","description":"","write_action":false,"price_micros":0,"input_schema":null},{"name":"run_command","description":"Return the dangerous-capability categories a tool name/description matches.","write_action":true,"price_micros":0,"input_schema":null}],"scan":{"score":75,"grade":"B","scanned_at":"2026-09-19T21:32:12.488Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-19T21:32:12.471Z","components":{"code":{"score":15,"max":25,"notes":["50 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":12,"max":15,"notes":["local package, no credentials required"]},"maintenance":{"score":15,"max":15,"notes":["last push 0 days ago"]},"identity":{"score":7,"max":10,"notes":["namespace and repository owner differ","GitHub account older than a year","website matches verified namespace"]}},"findings":[{"id":"exec.eval","severity":"medium","component":"code","title":"eval / new Function used","evidence":"skilltotal-0.49.0/skilltotal/engine.py: … False # A string a sink executes (`new Function(\"…\")`, `exec(\"…\")`) is code for every ru…"},{"id":"exec.shell-true","severity":"medium","component":"code","title":"subprocess with shell=True","evidence":"skilltotal-0.49.0/skilltotal/scanners/python_ast.py: … \"derived from untrusted input; avoid shell=True.\" ), capability…"}],"inputs":{"packages":[{"registryType":"pypi","identifier":"skilltotal","version":"0.49.0","found":true,"license":"Apache-2.0","dependencyCount":8,"publishedAt":"2026-09-18T23:21:32.011965Z","repositoryUrl":"https://github.com/pezhik/skilltotal"}],"repo":{"found":true,"owner":"pezhik","repo":"skilltotal","archived":false,"pushedAt":"2026-09-19T17:30:13Z","stars":3,"forks":0,"openIssues":0,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/2234432?v=4","ownerCreatedAt":"2012-08-28T12:57:41Z","license":"Apache-2.0"},"icon":{"url":"https://www.skilltotal.ai/icon.svg?icon.09cn5u6v249bl.svg","source":"registry"},"presence":{"stars":3,"forks":0,"downloadsWeek":1395,"license":"Apache-2.0","lastPushAt":"2026-09-19T17:30:13.000Z","score":39}}}},"grade_history":[{"kind":"restore","fromGrade":"C","toGrade":"B","reason":"score 75: eval / new Function used; subprocess with shell=True","createdAt":"2026-09-19T21:32:13.196Z"},{"kind":"restore","fromGrade":"D","toGrade":"C","reason":"score 57: Base64 decoded then executed; eval / new Function used; subprocess with shell=True","createdAt":"2026-09-19T21:03:46.592Z"}],"reviews":[]}