mcpField
A
Agent Skill & Config Security Audit

Agent Skill & Config Security Audit

Remote
github.com/tylerscomic-labSecurity0Updated 4w ago
Repository

About Agent Skill & Config Security Audit

Agent Skill & Config Security Audit is a static scanner for AI agent skill files and configurations, intended for review before installation. It detects hidden text, prompt injection, exfiltration patterns, and broad permissions without executing or fetching input.

Key features

  1. 01Decode invisible Unicode text
  2. 02Detect prompt-injection patterns
  3. 03Flag download-and-execute and obfuscation
  4. 04Check for credential exfiltration patterns
  5. 05Find broad permissions and risky configs

Use cases

  1. 01Scan third-party skill files before installation
  2. 02Review MCP server settings in agent configs
  3. 03Check skill scripts for hidden instructions or exfiltration commands

MCP support

It provides MCP tools including `audit_skill_file`, `audit_agent_config`, and `reveal_hidden_text`. It can be used through a hosted remote MCP endpoint or by running the server locally.

Configuration

Remote servers need no local install. Pick your client, then copy the config or install in one click.

Endpointhttps://agent-skill-audit-mcp.mcpize.run/mcp
Copy install command
Claude CodeTerminal
Cursor.cursor/mcp.json
VS Code.vscode/mcp.json
Claude Desktopclaude_desktop_config.json
Windsurf~/.codeium/windsurf/mcp_config.json

Run commands in a terminal; paste JSON into the client’s MCP config and restart. Servers that need sign-in will prompt on first connect.

Tools

Details

From the project README

Agent Skill & Config Security Audit

Security scanner for AI agent skills and config files (SKILL.md, CLAUDE.md, AGENTS.md, .mcp.json, settings.json). Finds hidden Unicode instructions, prompt injection, exfiltration commands and over-broad permissions before you install a skill.

Scan a skill before you install it

Agent skills and instruction files are read straight into your agent's context, and some ship scripts it can run. Research on public skill registries has found prompt injection and credential-stealing payloads in a large share of them. Installing a third-party skill is closer to adding a dependency than opening a document, and nothing scans them. This does.

What it catches

  • Hidden Unicode instructions: invisible "tag" characters that render as blank but that models can read, plus zero-width and bidi control characters. The hidden message is decoded for you.
  • Prompt injection: "ignore previous instructions", "do not tell the user", fake system messages, approval bypasses.
  • Download-and-execute and obfuscation: curl | bash, base64-decode-and-run, large encoded blobs.
  • Exfiltration shapes: network commands that reference env vars or credential files, request-catcher and tunnel hosts, sensitive paths like ~/.ssh and .aws/credentials.
  • Over-broad permissions: unrestricted Bash in allowed-tools, Bash(*) pre-approvals, bypassed permissions.
  • Risky agent configs: unpinned @latest MCP servers, inline secrets, plaintext remote servers, hooks that make network calls, API base-URL overrides, auto-trusted project MCP servers.

Tools

  • audit_skill_file: scan SKILL.md, CLAUDE.md, AGENTS.md, .cursorrules or a bundled script.
  • audit_agent_config: audit .mcp.json or .claude/settings.json.
  • reveal_hidden_text: find and decode invisible characters in any text, and return a cleaned copy.

Static analysis only. Nothing in your input is executed or fetched. A clean result is not a guarantee, so read bundled scripts too.

Use it

Hosted on MCPize with a free tier (10 calls a day). Remote MCP endpoint (streamable HTTP, API key from MCPize):

https://agent-skill-audit-mcp.mcpize.run/mcp

Or run it yourself:

npm install
node server.js   # listens on :8080, MCP at /mcp

MIT licensed.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.