Which clients support this MCP server?

It supports OpenClaw, Claude Desktop, Cursor, and Codex clients.

What types of threats does the scanner detect?

It detects credential theft, prompt injection, zero-width character attacks, shell injections, ClawHavoc malware indicators, scope creep, and memory poisoning.

How do I scan a skill file?

Use the 'scan_skill' tool with either a URL or raw content of the skill file.

Can I get a detailed report after scanning?

Yes, use the 'get_report' tool with the scan ID returned from 'scan_skill' to retrieve the full report.

Skillssafe MCP

MCP server that scans AI agent skills and configs for credential theft, prompt injection, malware, and other security threats.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Not yet automatically verified

We haven't yet run this listing's install command through our automated sandbox check. This isn't a red flag — we're steadily working through the catalog.

Manual Client & Custom JSON ConfigExpand JSON ▾

Client Config & Setup

Choose your client or environment

Target File:~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "gucci-atlasv-skillssafe-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "skillssafe-mcp"
      ]
    }
  }
}

💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.

Overview

This MCP server provides security scanning for AI agent skill files, MCP configurations, and system prompts to detect credential theft, prompt injection, zero-width character attacks, shell injections, and malware indicators like ClawHavoc. It returns risk assessments and threat details to help developers decide whether to install or review a skill. The server supports multiple clients via local commands or remote SSE and requires no signup or API key.

Use cases

Scan AI skill files before installation to detect security risks

Analyze MCP config and system prompts for injection or exfiltration threats

Retrieve detailed security reports for previously scanned skills

Integrate security scanning into AI agent development workflows

Key features

Detects credential theft and data exfiltration attempts

Identifies prompt injection and zero-width character attacks

Flags shell injection and reverse shell threats

Detects ClawHavoc malware indicators

Provides risk scores and install/review/block decisions

Supports multiple languages for scan results (English, Chinese, Japanese)

Capabilities & Tool Schemas (2)Self-reported

Inspect callable tools, capabilities, and parameters exposed to AI agents by Skillssafe MCP.

scan_skill

Scan an AI agent skill file for security threats before installation.

get_report

Retrieve a previously generated scan report.

Documentation Overview

skillssafe-mcp

MCP server for SkillsSafe — the security layer for AI agents.

Scan SKILL.md files, MCP configs, and system prompts for:

🔐 Credential theft & data exfiltration
💉 Prompt injection attacks
👻 Zero-width character attacks
🦠 ClawHavoc malware indicators
🐚 Shell injection & reverse shells
🔍 Scope creep & memory poisoning

Free. No API key. No signup.

Quick Start

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

config.json

{
  "mcpServers": {
    "skillssafe": {
      "command": "npx",
      "args": ["-y", "skillssafe-mcp"]
    }
  }
}

Cursor

Add to .cursor/mcp.json:

config.json

{
  "mcpServers": {
    "skillssafe": {
      "command": "npx",
      "args": ["-y", "skillssafe-mcp"]
    }
  }
}

Direct SSE (Remote)

For clients that support SSE transport:

Code

https://mcp.skillssafe.com/sse

Tools

`scan_skill`

Scan an AI agent skill file for security threats before installation.

Code

Parameters:
  url      - URL of skill to scan (GitHub raw URL, ClawHub URL, etc.)
  content  - Raw text content of skill to scan (alternative to url)
  lang     - Response language: "en" | "zh" | "ja" (default: "en")

Returns:
  decision    - INSTALL / REVIEW / BLOCK
  risk_score  - 0–100
  threats     - List of detected threats with severity
  scan_id     - ID for retrieving full report

`get_report`

Retrieve a previously generated scan report.

Code

Parameters:
  scan_id  - Scan ID returned by scan_skill

Registry

Official MCP Registry: com.skillssafe/scanner
Smithery: skillssafe
Glama: skillssafe-mcp

🛡️ Security Audit

This project is indexed by SkillsSafe.

You can audit this MCP server before installing it:

bash

openclaw mcp add skillssafe https://mcp.skillssafe.com/sse

Check out the community discussion on Cursor Forum.

License

MIT © SkillsSafe

Read the full README →View source on GitHub →

Related MCP Servers

View all in Security View all alternatives

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars

Stargazers on the source repository.

npm downloads

241

Package downloads in the last 30 days.

Last commit

6mo ago

Most recent push to the default branch.

Tools exposed

Callable tools this server registers over MCP.

Directory activity

1 views

Config copies, upvotes, and views on AllMCPs.

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about Skillssafe MCP

No, the server is free to use without any API key or signup.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/gucci-atlasv-skillssafe-mcp?style=directory)](https://allmcps.com/mcp/gucci-atlasv-skillssafe-mcp)

HTML Embed

<a href="https://allmcps.com/mcp/gucci-atlasv-skillssafe-mcp"><img src="https://allmcps.com/api/badge/gucci-atlasv-skillssafe-mcp?style=directory" alt="Skillssafe MCP on AllMCPs" /></a>

Technical Specs & Signals

CategorySecurity

53Quality signal: Good · 53/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership10/20

Documentation & tools27/30

Adoption & activity3/15

Community engagement0/10

A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 28d ago via OSV.dev · skillssafe-mcp (npm)

★ Featured

AllMCPs Server

The official MCP server for AllMCPs.com - submit and manage tools directly from your AI. The open directory for MCP servers. Connect Claude, Cursor, Windsurf, and AI agents to databases, tools, files, and APIs. Explore 10,000+ servers. AllMCPs is the premier, open directory for discovering, evaluating, and installing Model Context Protocol (MCP) servers to equip AI agents and LLMs with real-world superpowers.

Explore Server →

Own this project?

This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge — proof is checked automatically, then reviewed by our team.

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 🔒 Security →Best MCP servers for Security →Alternatives to Skillssafe MCP →Install in Claude Desktop Install in Cursor Install in VS Code

Skillssafe MCP

MCP server that scans AI agent skills and configs for credential theft, prompt injection, malware, and other security threats.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Not yet automatically verified

We haven't yet run this listing's install command through our automated sandbox check. This isn't a red flag — we're steadily working through the catalog.

Manual Client & Custom JSON ConfigExpand JSON ▾

Client Config & Setup

Choose your client or environment

Target File:~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "gucci-atlasv-skillssafe-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "skillssafe-mcp"
      ]
    }
  }
}

💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.

Overview

Use cases

Scan AI skill files before installation to detect security risks

Analyze MCP config and system prompts for injection or exfiltration threats

Retrieve detailed security reports for previously scanned skills

Integrate security scanning into AI agent development workflows

Key features

Detects credential theft and data exfiltration attempts

Identifies prompt injection and zero-width character attacks

Flags shell injection and reverse shell threats

Detects ClawHavoc malware indicators

Provides risk scores and install/review/block decisions

Supports multiple languages for scan results (English, Chinese, Japanese)

Capabilities & Tool Schemas (2)Self-reported

Inspect callable tools, capabilities, and parameters exposed to AI agents by Skillssafe MCP.

scan_skill

Scan an AI agent skill file for security threats before installation.

get_report

Retrieve a previously generated scan report.

Documentation Overview

skillssafe-mcp

MCP server for SkillsSafe — the security layer for AI agents.

Scan SKILL.md files, MCP configs, and system prompts for:

🔐 Credential theft & data exfiltration
💉 Prompt injection attacks
👻 Zero-width character attacks
🦠 ClawHavoc malware indicators
🐚 Shell injection & reverse shells
🔍 Scope creep & memory poisoning

Free. No API key. No signup.

Quick Start

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

config.json

{
  "mcpServers": {
    "skillssafe": {
      "command": "npx",
      "args": ["-y", "skillssafe-mcp"]
    }
  }
}

Cursor

Add to .cursor/mcp.json:

config.json

{
  "mcpServers": {
    "skillssafe": {
      "command": "npx",
      "args": ["-y", "skillssafe-mcp"]
    }
  }
}

Direct SSE (Remote)

For clients that support SSE transport:

Code

https://mcp.skillssafe.com/sse

Tools

`scan_skill`

Scan an AI agent skill file for security threats before installation.

Code

Parameters:
  url      - URL of skill to scan (GitHub raw URL, ClawHub URL, etc.)
  content  - Raw text content of skill to scan (alternative to url)
  lang     - Response language: "en" | "zh" | "ja" (default: "en")

Returns:
  decision    - INSTALL / REVIEW / BLOCK
  risk_score  - 0–100
  threats     - List of detected threats with severity
  scan_id     - ID for retrieving full report

`get_report`

Retrieve a previously generated scan report.

Code

Parameters:
  scan_id  - Scan ID returned by scan_skill

Registry

Official MCP Registry: com.skillssafe/scanner
Smithery: skillssafe
Glama: skillssafe-mcp

🛡️ Security Audit

This project is indexed by SkillsSafe.

You can audit this MCP server before installing it:

bash

openclaw mcp add skillssafe https://mcp.skillssafe.com/sse

Check out the community discussion on Cursor Forum.

License

Read the full README →View source on GitHub →

Related MCP Servers

View all in Security View all alternatives

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars

Stargazers on the source repository.

npm downloads

241

Package downloads in the last 30 days.

Last commit

6mo ago

Most recent push to the default branch.

Tools exposed

Callable tools this server registers over MCP.

Directory activity

1 views

Config copies, upvotes, and views on AllMCPs.

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about Skillssafe MCP

No, the server is free to use without any API key or signup.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/gucci-atlasv-skillssafe-mcp?style=directory)](https://allmcps.com/mcp/gucci-atlasv-skillssafe-mcp)

HTML Embed

<a href="https://allmcps.com/mcp/gucci-atlasv-skillssafe-mcp"><img src="https://allmcps.com/api/badge/gucci-atlasv-skillssafe-mcp?style=directory" alt="Skillssafe MCP on AllMCPs" /></a>

Technical Specs & Signals

CategorySecurity

53Quality signal: Good · 53/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership10/20

Documentation & tools27/30

Adoption & activity3/15

Community engagement0/10

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 28d ago via OSV.dev · skillssafe-mcp (npm)

★ Featured

AllMCPs Server

Explore Server →

Own this project?

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 🔒 Security →Best MCP servers for Security →Alternatives to Skillssafe MCP →Install in Claude Desktop Install in Cursor Install in VS Code