agent skill security scanner

The problem

Third-party agent skills and MCP servers introduce foreign instructions and code into your agent's trust boundary. Identifying prompt injection, hidden exfiltration directives, or capability-purpose mismatches requires a semantic audit that traditional code scanners ignore.

What it does

• Audits SKILL.md and tool manifests for hidden instructions or model-steering directives.
• Evaluates bundled source code for network egress, filesystem reach, and unauthorized secret access.
• Identifies capability-purpose mismatches where a skill's permissions exceed its stated utility.
• Inventories un-auditable external references like curl | sh or remote runtime configs.
• Produces a definitive INSTALL, REVIEW, or BLOCK gate verdict based on evidence-backed findings.

Why this beats prompting it yourself

Static analysis for agents requires reading text as instructions, not just documentation. This skill enforces a disciplined protocol that prevents false negatives caused by keyword scanning, ensuring every file and model directive is semantically vetted rather than just grepped. It bridges the gap between classic security audits and LLM-specific vulnerability classes.

Use cases

• Vetting an open-source MCP server before allowing it access to your local environment.
• Auditing your own custom skills for potential prompt injection before deployment.
• Building a security gate for an internal agent skill store or CI/CD pipeline.
• Reviewing tool descriptions to prevent agentic data exfiltration through tool poisoning.

Known limitations

Static audit only. Cannot detect runtime tool-response injection where malicious payloads are returned by a live API. Requires manual verification of obfuscated binaries or private repos.