Agent Skill Scanner
About
Scan OpenClaw SKILL.md and MCP tool definition files for security vulnerabilities. 22 rules across prompt injection, capability escalation, data exfiltration, encoded payloads, and composition risks. The only scanner targeting agent skill file formats.
Details
- Author
- rexcoleman
- Downloads
- 397
- Categories
- AI, Security
Jump to
- 22 detection rules across prompt injection, capability escalation, data exfiltration, encoded payloads, and composition risks.
- Targets OpenClaw SKILL.md and MCP tool definition formats (missed by generic SAST tools).
- Returns findings with severity, rule ID, description, and evidence.
- Recursively scans directories for agent skill files.
- Runs fully locally via stdio; no network calls after install.
- Source is open and auditable on GitHub.
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Agent Skill ScannerCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Install with pip install agent-skill-scanner, then configure in Claude Code's MCP settings by adding the agent-skill-scanner server pointing to the server.py script. Use the tools scan_skill_file (to scan a single file) or scan_directory (to recursively scan a directory) from within Claude.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"agent skill scanner": {
"agent-skill-scanner": {
"command": "python3",
"args": [
"/path/to/agent-skill-scan-mcp/server.py"
],
"env": []
}
}
}
}McpServers
{
"agent-skill-scanner": {
"command": "python3",
"args": [
"/path/to/agent-skill-scan-mcp/server.py"
],
"env": []
}
}agent-skill-scanner MCP Server
> Last updated: 2026-03-31
Scan OpenClaw SKILL.md and Model Context Protocol (MCP) tool definition files for security vulnerabilities — directly from Claude Code.
22 detection rules across prompt injection, capability escalation, data exfiltration, encoded payloads, and composition risks. This is the only scanner targeting agent skill file formats specifically. Generic Static Application Security Testing (SAST) tools produce zero detections on these formats.
Install
Requires Python 3.10+ and the scanner engine:
pip install agent-skill-scanner
Configure in Claude Code
Add to your Claude Code MCP settings:
{
"mcpServers": {
"agent-skill-scanner": {
"command": "python3",
"args": ["/path/to/agent-skill-scan-mcp/server.py"]
}
}
}
Replace /path/to/ with the actual path where you cloned this repo.
Tools
scan_skill_file
Scan a single skill file for security vulnerabilities.
scan_skill_file(file_path="/path/to/SKILL.md")
Returns findings with severity, rule ID, description, and evidence.
scan_directory
Recursively find and scan all agent skill files in a directory.
scan_directory(directory_path="/path/to/skills/")
Returns aggregated findings across all discovered skill files.
What it detects
22 rules across 5 categories:
| Category | Examples |
|----------|---------|
| Prompt injection | System prompt override, role hijacking, instruction injection |
| Capability escalation | Privilege escalation, shell spawning, persistence mechanisms |
| Data exfiltration | Credential access, environment variable reads, outbound transfer |
| Encoded payloads | Base64 commands, hex payloads, obfuscated strings |
| Composition risks | Unrestricted tool chaining, cross-skill data flow, trust violations |
Differentiator
This scanner targets OpenClaw SKILL.md and MCP tool definition formats — markdown-embedded code and YAML skill configurations that generic SAST tools (semgrep, CodeQL) miss entirely. If you're scanning general Python/JavaScript code, use Snyk or semgrep. If you're scanning agent skill files, this is the only tool that covers the format.
Trust & Security
This server runs locally via stdio. No network calls beyond the initial pip install. No data collection. No telemetry.
Source is fully auditable in this repo. The scanner engine source is at github.com/rexcoleman/agent-skill-scanner.
Limitations
- Pattern-based detection only — no semantic analysis
- Designed for OpenClaw SKILL.md and MCP tool definitions
- Rules cover known attack patterns from published research, not zero-days
Links
- Scanner (PyPI): agent-skill-scanner
- GitHub Action: agent-skill-scan-action
- Research: rexcoleman.dev
License
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
