mcpField
S
skill-scanner

skill-scanner

github.com/bvinci1-designSecurity1130 installsUpdated 39w ago
Repository

About skill-scanner

skill-scanner is a security auditing skill for Clawdbot and MCP skills. It checks skill folders for suspicious behavior and presents findings as Markdown or JSON, with an optional Streamlit interface.

Key features

  1. 01Scans skill folders for threats
  2. 02Detects data exfiltration patterns
  3. 03Flags system modification and code execution risks
  4. 04Finds crypto-mining, backdoors, and obfuscation
  5. 05Exports Markdown or JSON reports
  6. 06Optional Streamlit web interface

Use cases

  1. 01Audit a skill before installing or using it
  2. 02Check a skill for data theft indicators
  3. 03Review potential backdoors and code execution
  4. 04Inspect findings in a web interface

MCP support

The skill can be invoked within Clawdbot to scan skills; it audits MCP skills but does not describe exposing MCP tools or resources.

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/bvinci1-design/skill-scanner --skill skill-scanner

After installing, type/skill-scannerin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

LICENSE
.gitignore
README.md
skill_scanner.py
streamlit_ui.py

Details

From the project README

Skill Scanner

Security audit tool for Clawdbot/MCP skills - scans for malware, spyware, crypto-mining, and malicious patterns.

Capabilities

  • Scan skill folders for security threats
  • Detect data exfiltration patterns
  • Identify system modification attempts
  • Catch crypto-mining indicators
  • Flag arbitrary code execution risks
  • Find backdoors and obfuscation techniques
  • Output reports in Markdown or JSON format
  • Provide Web UI via Streamlit

Usage

Command Line
python skill_scanner.py /path/to/skill-folder
Within Clawdbot
"Scan the [skill-name] skill for security issues using skill-scanner"
"Use skill-scanner to check the youtube-watcher skill"
"Run a security audit on the remotion skill"
Web UI
pip install streamlit
streamlit run streamlit_ui.py

Requirements

  • Python 3.7+
  • No additional dependencies (uses Python standard library)
  • Streamlit (optional, for Web UI)

Entry Point

  • CLI: skill_scanner.py
  • Web UI: streamlit_ui.py

Tags

#security #malware #spyware #crypto-mining #scanner #audit #code-analysis #mcp #clawdbot #agent-skills #safety #threat-detection #vulnerability

Comments

Markdown supported