CLI appSecurity and privacy

mcp-skills-vault

Match, verify, and audit MCP servers before adding them to a project.

Stars: 0
Forks: 0
Updated: Updated Jun 22, 2026

CLI appSecurity and privacy

mcp-skills-vault

Match, verify, and audit MCP servers before adding them to a project.

Stars: 0
Forks: 0
Updated: Updated Jun 22, 2026

CLI appSecurity and privacy

SkillSpector

@NVIDIAPython

Scan agent skills for malicious instructions, unsafe code, and supply-chain risks

Project overview

NVIDIA SkillSpector examines Git repositories, URLs, archives, directories, or individual files before an agent skill is installed. It checks dozens of patterns spanning prompt injection, exfiltration, privilege escalation, dangerous code, dependency vulnerabilities, MCP least privilege, and tool poisoning, then produces terminal, JSON, Markdown, or SARIF reports with risk scores. Scanned skills are never executed. Optional LLM analysis sends file contents to the configured provider, while static-only mode keeps that content local.

Stars: 13,153
Forks: 1,066
License: Apache-2.0

CLI appSecurity and privacyClaude Code

agent-scan

@snykPython

Scan local agents, MCP servers, and skills for security risks.

Project overview

Snyk Agent Scan finds MCP configurations and Agent Skills used by tools such as Claude, Cursor, Windsurf, and Gemini CLI, then checks for prompt injection, tool poisoning, tool shadowing, malicious payloads, unsafe credential handling, and hardcoded secrets. It runs directly through uvx. Scanning a stdio MCP server executes its configured command, so review the command and approve it only through the consent prompt.

Stars: 2,778
Forks: 246
License: Apache-2.0

CLI appSecurity and privacyClaude Code

Semia

@berabuddiesPython

Audit agent skills for commands, network access, secrets, and tools without executing them.

Project overview

Semia analyzes an Agent Skill before the user decides to trust or run it. The scanner reads the skill as data and never executes its embedded commands, then identifies possible actions, effects, network access, secret reads, and tool invocations with evidence tied to source lines. It can be used through a Python CLI or installed as a plugin for Codex, Claude Code, or OpenClaw. A configured LLM provider is required for the full prepare, synthesize, detect, and report workflow.

Stars: 553
Forks: 59
License: Apache-2.0

CLI appSecurity and privacyLinux

skill-security-scan

@huiferPython

Scan Claude Skills for risky network, file, command, and injection patterns.

Project overview

This command-line scanner reviews third-party Claude Skills before installation for suspicious network access, sensitive file operations, dangerous commands, dynamic execution, and injection patterns. It can produce HTML, console, or JSON reports and supports custom rules and allowlists, while performing static analysis without executing the skill code. Its findings are a review aid rather than a guarantee that every security risk will be detected.

Stars: 159
Forks: 12
License: MIT

mcp-skills-vault

mcp-skills-vault

Project overview

Repository facts

Related projects

SkillSpector

agent-scan

Semia

skill-security-scan