skill-audit-mcp — Claude Code MCP server: scan skills for attacks
A static scanner for MCP servers, agent skills and plugins. It flags 17 attack patterns across four severity levels before you install someone else's code.
claude mcp add --transport http skill-audit-mcp https://eltociear-skill-audit.hf.space/mcpWhat skill-audit-mcp does
The server reads code and instruction files looking for behaviour that signals an attack: fetching and running remote payloads, sending credentials out, generating keys, writing to sensitive directories, harvesting seed phrases. It also catches auth bypass, identity impersonation and prompt injection. Severity comes from the worst match in the scan, not an average — a single credential leak lands as CRITICAL even if everything around it looks clean.
Two ways to connect: a hosted HTTP endpoint, or the local Docker image ghcr.io/eltociear/skill-audit-mcp:mcp-1.2.0. Beyond the MCP server there is a CLI built on the Python 3.8+ standard library and a GitHub Action that scans pull requests and can push SARIF into GitHub Code Scanning. In the CLI, findings carry a location label: production sets the exit code, while documentation and test are only listed unless you pass --include-nonproduction. Files an agent treats as instructions — SKILL.md, AGENTS.md, CLAUDE.md, .cursorrules, anything inside .claude/commands|agents|skills/ or .cursor/rules/ — count as production, because for a skill they are the program itself.
Run it before installing a plugin you did not write. The scanner watches behaviour, so leaked API keys are outside its scope; the same author ships secrets-audit-mcp with 32 provider rules for that. Matches inside comments, string literals and markdown tables still get reported, but drop in weight when harm would require execution.
What it helps with
- check an unfamiliar MCP server for hidden command execution
- catch credential exfiltration in a skill before installing it
- scan pull requests for prompt injection and auth bypass
- separate agent instruction files from ordinary docs during a scan
- push scan results into GitHub Code Scanning
Example prompts for the agent
- Scan
./some-skill/and show me findings at HIGH or above - Check
server.pyfor remote download-and-execute patterns - Audit this MCP server and explain what you found
How to install skill-audit-mcp
1Platform CLI: remote server
claude mcp add --transport http skill-audit-mcp https://eltociear-skill-audit.hf.space/mcp2Platform CLI
claude mcp add skill-audit-mcp -- docker run -i --rm ghcr.io/eltociear/skill-audit-mcp:mcp-1.2.01Platform CLI: remote server
codex mcp add skill-audit-mcp --url https://eltociear-skill-audit.hf.space/mcp2Platform CLI
codex mcp add skill-audit-mcp -- docker run -i --rm ghcr.io/eltociear/skill-audit-mcp:mcp-1.2.0Config file
{
"mcpServers": {
"skill-audit-mcp": {
"url": "https://eltociear-skill-audit.hf.space/mcp"
}
}
}{
"mcpServers": {
"skill-audit-mcp": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"ghcr.io/eltociear/skill-audit-mcp:mcp-1.2.0"
]
}
}
}Config file
{
"servers": {
"skill-audit-mcp": {
"type": "http",
"url": "https://eltociear-skill-audit.hf.space/mcp"
}
}
}{
"servers": {
"skill-audit-mcp": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"ghcr.io/eltociear/skill-audit-mcp:mcp-1.2.0"
]
}
}
}1Platform CLI: remote server
gemini mcp add -t http skill-audit-mcp https://eltociear-skill-audit.hf.space/mcp2Platform CLI
gemini mcp add skill-audit-mcp docker run -i --rm ghcr.io/eltociear/skill-audit-mcp:mcp-1.2.0Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about skill-audit-mcp
How do I install skill-audit-mcp in Claude Code?
Add the hosted server with claude mcp add --transport http skill-audit-mcp https://eltociear-skill-audit.hf.space/mcp. For a local run use claude mcp add skill-audit-mcp -- docker run -i --rm ghcr.io/eltociear/skill-audit-mcp:mcp-1.2.0.
What does skill-audit-mcp do?
It scans code and instruction files for malicious behaviour: running downloaded code, leaking secrets, prompt injection, auth bypass. That covers 17 attack patterns and 65 regex signatures across four severity levels.
How is it different from secrets-audit-mcp?
This one looks at behaviour, while secrets-audit-mcp hunts leaked keys and tokens with 32 provider rules. The author suggests running both.
