Skillsmith MCP server

by smith-horn·io.github.smith-horn/skillsmith·v0.7.16

Share agent skills across your team, scan them for risk, and track what's actually used.

C65/100grade C

What users say

No reviews yet

Safety scan

C65/100

Adoption

Growing

78 stars

Reviews

Nobody has reviewed Skillsmith yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

No tool declarations could be read from the package source. They show once the server is installed.

scanner v0.1.3 · 2026-09-19 · same rubric, same numbers if you re-run it

1 high1 medium

Code scan606 source files scanned8/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancelast push 0 days ago15/15
Maintainer identityregistry namespace matches repository owner7/10

highShell command built from a string (injection risk)exec.shell-concat

dist/src/index.startup-helpers.js: …'win32' ? 'start' : 'xdg-open'; exec(`${cmd} "${userGuidePath}"`); console.log(`…

mediumNetwork call to a raw IP addressnet.raw-ip

dist/src/tools/integration-tools.service.test.js: … await expect(svc.createWebhook('https://192.168.1.1/hook', ['skill.install'])).rejects.toThr…

Overall 65/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

Runs npx -y @skillsmith/mcp-server on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add skillsmith -- npx -y @skillsmith/mcp-server

Is Skillsmith MCP server safe?: With care: it is graded C, so read the findings first (65/100). Read the Skillsmith safety report
How do I install Skillsmith?: It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does Skillsmith need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Skillsmith maintained?: The last commit was in the last day (2026-09-19). The latest release is v0.7.16.
What can I use instead of Skillsmith?: Servers from other publishers that do the same job: Yotta Verify MCP server, Ios Agent Skill MCP server and Pm Claude Skills MCP server. Compare all Skillsmith alternatives.

Same job from other publishers: the closest match first, then the best rated.

Yotta Verify
Pre-install security scanner for AI agent skills (local stdio MCP). Offline static scan; no upload.
not reviewed
Growing
A
Ios Agent Skill
Swift reviews, local Apple references, app scaffolding and iOS simulator workflows.
not reviewed
Established
A
Pm Claude Skills
1174 professional Agent Skills + workflow recipes — searchable & fetchable over MCP.
not reviewed
Established
A
Bomly
Give your coding agent the dependency graph it is about to change: scan, diff, explain, audit
not reviewed
Growing
B
prompt-protection
Scan prompts, tool definitions and model output for injection, and guard agent tool calls.
not reviewed
Growing
A