Agent Skill & Config Security Audit MCP server
online · 100% uptimeScan AI agent skills and configs for hidden Unicode, prompt injection and exfiltration.
0 stars
Reviews
Write oneNobody has reviewed Agent Skill & Config Security Audit yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
Agent Skill & Config Security Audit tools
Tool list not cached yet. `describe` through the gateway fetches it live.
Public scan report
scanner v0.1.10 · 2026-10-02 · same rubric, same numbers if you re-run it
- –Code scanremote-only server, no package to scann/a
- Live reliabilityremote reachable in 406ms (auth required)20/20
- –Tool poisoningtools not inspected (endpoint requires auth); not countedn/a
- Auth qualityOAuth resource metadata advertised on 40115/15
- Maintenancelast push 0 days ago15/15
- Maintainer identityregistry namespace matches repository owner6/10
How Agent Skill & Config Security Audit compares
Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 93/100
- higher than 96% of 4,460 AI and agents servers
- Uptime
- 100%
- of our recent checks; the typical remote AI and agents server answers 100%
- Response time
- 366 ms
- faster than 38% of 2,331 AI and agents servers
Install Agent Skill & Config Security Audit in Claude Code, Cursor or VS Code
claude mcp add --transport http agent-skill-audit-mcp https://agent-skill-audit-mcp.mcpize.run/mcp
What the publisher says
From the Agent Skill & Config Security Audit repository's README, as published. We do not edit it. Read it on GitHub
Agent Skill & Config Security Audit
Security scanner for AI agent skills and config files (SKILL.md, CLAUDE.md, AGENTS.md, .mcp.json, settings.json). Finds hidden Unicode instructions, prompt injection, exfiltration commands and over-broad permissions before you install a skill.
Scan a skill before you install it
Agent skills and instruction files are read straight into your agent's context, and some ship scripts it can run. Research on public skill registries has found prompt injection and credential-stealing payloads in a large share of them. Installing a third-party skill is closer to adding a dependency than opening a document, and nothing scans them. This does.
What it catches
- Hidden Unicode instructions: invisible "tag" characters that render as blank but that models can read, plus zero-width and bidi control characters. The hidden message is decoded for you.
- Prompt injection: "ignore previous instructions", "do not tell the user", fake system messages, approval bypasses.
- Download-and-execute and obfuscation: curl | bash, base64-decode-and-run, large encoded blobs.
- Exfiltration shapes: network commands that reference env vars or credential files, request-catcher and tunnel hosts, sensitive paths like ~/.ssh and .aws/credentials.
- Over-broad permissions: unrestricted Bash in allowed-tools, Bash(*) pre-approvals, bypassed permissions.
- Risky agent configs: unpinned @latest MCP servers, inline secrets, plaintext remote servers, hooks that make network calls, API base-URL overrides, auto-trusted project MCP servers.
Tools
- auditskillfile: scan SKILL.md, CLAUDE.md, AGENTS.md, .cursorrules or a bundled script.
- auditagentconfig: audit .mcp.json or .claude/settings.json.
- revealhiddentext: find and decode invisible characters in any text, and return a cleaned copy.
Static analysis only. Nothing in your input is executed or fetched. A clean result is not a guarantee, so read bundled scripts too.
Use it
Hosted on MCPize with a free tier (10 calls a day). Remote MCP endpoint (streamable HTTP, API key from MCPize):
https://agent-skill-audit-mcp.mcpize.run/mcpOr run it yourself:
npm install
node server.js # listens on :8080, MCP at /mcpMIT licensed.
Nothing above is checked by us. What we check is on the safety report.
Agent Skill & Config Security Audit: common questions
- Is Agent Skill & Config Security Audit MCP server safe?
- Yes, by our scan: it is graded A (93/100). Read the Agent Skill & Config Security Audit safety report
- How do I install Agent Skill & Config Security Audit?
- It runs remotely at agent-skill-audit-mcp.mcpize.run. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
- Does Agent Skill & Config Security Audit need an API key?
- No key to paste: it signs you in with OAuth when your client connects.
- Is Agent Skill & Config Security Audit maintained?
- The last commit was 33 days ago (2026-10-01). The latest release is v1.0.0.
- Is Agent Skill & Config Security Audit up?
- 100% of our last 28 checks got an answer. We check remote servers about four times a day.
- What can I use instead of Agent Skill & Config Security Audit?
- Servers from other publishers that do the same job: Agent Security Scanner MCP server, Skillsmith MCP server and Shellward MCP server.
- How does Agent Skill & Config Security Audit compare with other AI and agents MCP servers?
- safety score 93/100 (higher than 96% of 4,460 AI and agents servers); uptime 100% (of our recent checks; the typical remote AI and agents server answers 100%); response time 366 ms (faster than 38% of 2,331 AI and agents servers). Full comparison.
Alternatives to Agent Skill & Config Security Audit
Same job from other publishers: the closest match first, then the best rated.
- Agent Security ScannerSecurity layer for AI agents: blocks prompt injection, detects fake packages, scans vulnerabilities.not reviewedEstablishedC
- SkillsmithShare agent skills across your team, scan them for risk, and track what's actually used.not reviewedEstablishedB
- ShellwardAI agent security: 7 MCP tools for injection detection, PII scanning, command safety, DLP.not reviewedEstablishedA
- HOL GuardLocal-first AI agent security evidence and approval workflows through HOL Guard's stdio MCP server.not reviewedEstablishedA
- Pm Claude Skills1310 professional Agent Skills + workflow recipes — searchable & fetchable over MCP.not reviewedEstablishedA
