SkillsSafe Security Scanner

AI skill security scanner. Detects prompt injection, credential theft, ClawHavoc. Free, no signup.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Manual Client & Custom JSON ConfigExpand JSON ▾

Client Config & Setup

Remote HTTP

Choose your client or environment

Target File:~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "skillssafe-security-scanner": {
      "url": "https://skillssafe.com/api/mcp"
    }
  }
}

💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.

Documentation Overview

SkillsSafe — AI Skill Security Scanner

Free, no-signup security scanner for AI agent skills. Scan any SKILL.md, MCP config, or system_prompt for threats before installing.

🌐 skillssafe.com

What Is SkillsSafe?

As AI agents become more powerful, malicious skills can steal credentials, exfiltrate data, or hijack your agent's behavior. SkillsSafe scans skill files before you install them — the same way an antivirus scans software before you run it.

Supported platforms: OpenClaw · Claude Code · Cursor · Codex · any MCP-compatible agent

Features

🔍 Security Scanner

Paste content, enter a URL, or upload a file to scan for:

Threat	Description
Credential Theft	Attempts to access API keys, tokens, or passwords
Data Exfiltration	Skills that send your data to external servers
Prompt Injection	Hidden instructions that hijack agent behavior
Shell Injection	Reverse shell or arbitrary command execution
Zero-Width Characters	Invisible Unicode characters hiding malicious instructions
Scope Creep	Skills requesting permissions beyond their stated purpose
Memory Poisoning	Attempts to corrupt agent memory or context
Privacy Risk	Unnecessary access to personal or sensitive data

Each scan returns a risk score, severity rating (SAFE / CAUTION / DANGER / CRITICAL), and a shareable report link.

👁️ Zero-Width Character Detector

Visualize invisible Unicode characters (U+200B, U+200C, U+200D, U+FEFF, etc.) hidden inside text. Attackers embed these to create prompts that look safe to humans but carry hidden instructions for AI agents.

🔌 MCP Server Integration

Native Model Context Protocol support — let your agent automatically check skill safety before installation. No API key required.

bash

# OpenClaw (one-line setup)
openclaw mcp add https://skillssafe.com/api/mcp

Available MCP tools:

scan_url — Scan a skill by URL
scan_content — Scan skill content directly
get_report — Retrieve a full scan report

📡 REST API

Works with any agent, script, or CI/CD pipeline.

bash

# Scan by URL
curl -X POST https://skillssafe.com/api/v1/scan/url \
  -H "Content-Type: application/json" \
  -d '{"url": "https://clawhub.ai/skills/example"}'

# Scan by content
curl -X POST https://skillssafe.com/api/v1/scan/content \
  -H "Content-Type: application/json" \
  -d '{"content": "...skill content..."}'

Full OpenAPI spec: https://skillssafe.com/api/v1/openapi.json

Pages

Route	Description
`/`	Main security scanner
`/zero-width-detector`	Hidden Unicode character detector
`/api-docs`	Interactive API documentation
`/integrate`	Integration guide for MCP & REST API
`/feedback`	Bug reports and feature requests

Getting Started (Local Development)

Terminal

npm install
npm run dev

Open http://localhost:3000 in your browser.

Environment Variables

bash

# .env.local
# (see wrangler.toml for Cloudflare Workers configuration)

Tech Stack

Framework: Next.js (App Router)
Deployment: Cloudflare Workers via @opennextjs/cloudflare
Database: Cloudflare D1 (SQLite)
i18n: next-intl (English · 中文 · 日本語)

Pricing

100% Free · No Signup · No Rate Limits for Humans

API rate limit: 60 requests/hour (no API key required).

Feedback & Support

Found a bug or false positive? Send feedback or email support@skillssafe.com.

SkillsSafe is an independent security tool, not affiliated with Anthropic, OpenClaw, or Cisco.

Read the full README →View source on GitHub →

Related MCP Servers

View all in Security View all alternatives

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about SkillsSafe Security Scanner

SkillsSafe Security Scanner is a hosted MCP server. Add it as a remote server in your client's config: "mcpServers": { "skillssafe-security-scanner": { "url": "https://skillssafe.com/api/mcp" } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

SkillsSafe Security Scanner AllMCPs Directory Badge

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/skillssafe-security-scanner?style=directory)](https://allmcps.com/mcp/skillssafe-security-scanner)

HTML Embed

<a href="https://allmcps.com/mcp/skillssafe-security-scanner"><img src="https://allmcps.com/api/badge/skillssafe-security-scanner?style=directory" alt="SkillsSafe Security Scanner on AllMCPs" /></a>

Technical Specs & Signals

CategorySecurity

6/8 checks healthy over the last 45d

35Quality signal: Fair · 35/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership10/20

Documentation & tools16/30

Adoption & activity0/15

Community engagement0/10

A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.

★ Featured

Moxie Docs MCP

MCP & Agent Skills for Automated Documentation, and codebase conventions + context

Explore Server →

Own this project?

This directory is pre-filled from public sources. Claim via GitHub README, site badge, or DNS TXT to unlock edit access and the Official badge — proof is checked automatically, then reviewed by our team.

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.

Explore more

More in 🔒 Security →Best MCP servers for Security →Alternatives to SkillsSafe Security Scanner →Install in Claude Desktop Install in Cursor Install in VS Code Setup guides for all 13 MCP clients

SkillsSafe Security Scanner

AI skill security scanner. Detects prompt injection, credential theft, ClawHavoc. Free, no signup.

Quick Install

Automated & IDE Setup

Copy the AI prompt to install this server into Claude Code, Cursor, or another agent — or use 1-click editor setup below.

Add to Cursor Add to VS Code

Manual Client & Custom JSON ConfigExpand JSON ▾

Client Config & Setup

Remote HTTP

Choose your client or environment

Target File:~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "skillssafe-security-scanner": {
      "url": "https://skillssafe.com/api/mcp"
    }
  }
}

💡 Paste the JSON block into your client's configuration file under mcpServers, then restart the application.

Documentation Overview

SkillsSafe — AI Skill Security Scanner

Free, no-signup security scanner for AI agent skills. Scan any SKILL.md, MCP config, or system_prompt for threats before installing.

🌐 skillssafe.com

What Is SkillsSafe?

Supported platforms: OpenClaw · Claude Code · Cursor · Codex · any MCP-compatible agent

Features

🔍 Security Scanner

Paste content, enter a URL, or upload a file to scan for:

Threat	Description
Credential Theft	Attempts to access API keys, tokens, or passwords
Data Exfiltration	Skills that send your data to external servers
Prompt Injection	Hidden instructions that hijack agent behavior
Shell Injection	Reverse shell or arbitrary command execution
Zero-Width Characters	Invisible Unicode characters hiding malicious instructions
Scope Creep	Skills requesting permissions beyond their stated purpose
Memory Poisoning	Attempts to corrupt agent memory or context
Privacy Risk	Unnecessary access to personal or sensitive data

Each scan returns a risk score, severity rating (SAFE / CAUTION / DANGER / CRITICAL), and a shareable report link.

👁️ Zero-Width Character Detector

🔌 MCP Server Integration

Native Model Context Protocol support — let your agent automatically check skill safety before installation. No API key required.

bash

# OpenClaw (one-line setup)
openclaw mcp add https://skillssafe.com/api/mcp

Available MCP tools:

scan_url — Scan a skill by URL
scan_content — Scan skill content directly
get_report — Retrieve a full scan report

📡 REST API

Works with any agent, script, or CI/CD pipeline.

bash

# Scan by URL
curl -X POST https://skillssafe.com/api/v1/scan/url \
  -H "Content-Type: application/json" \
  -d '{"url": "https://clawhub.ai/skills/example"}'

# Scan by content
curl -X POST https://skillssafe.com/api/v1/scan/content \
  -H "Content-Type: application/json" \
  -d '{"content": "...skill content..."}'

Full OpenAPI spec: https://skillssafe.com/api/v1/openapi.json

Pages

Route	Description
`/`	Main security scanner
`/zero-width-detector`	Hidden Unicode character detector
`/api-docs`	Interactive API documentation
`/integrate`	Integration guide for MCP & REST API
`/feedback`	Bug reports and feature requests

Getting Started (Local Development)

Terminal

npm install
npm run dev

Open http://localhost:3000 in your browser.

Environment Variables

bash

# .env.local
# (see wrangler.toml for Cloudflare Workers configuration)

Tech Stack

Framework: Next.js (App Router)
Deployment: Cloudflare Workers via @opennextjs/cloudflare
Database: Cloudflare D1 (SQLite)
i18n: next-intl (English · 中文 · 日本語)

Pricing

100% Free · No Signup · No Rate Limits for Humans

API rate limit: 60 requests/hour (no API key required).

Feedback & Support

Found a bug or false positive? Send feedback or email support@skillssafe.com.

SkillsSafe is an independent security tool, not affiliated with Anthropic, OpenClaw, or Cisco.

Read the full README →View source on GitHub →

Related MCP Servers

View all in Security View all alternatives

Reviews

No reviews yet — be the first to share how this listing worked for you.

Frequently Asked Questions about SkillsSafe Security Scanner

SkillsSafe Security Scanner is a hosted MCP server. Add it as a remote server in your client's config: "mcpServers": { "skillssafe-security-scanner": { "url": "https://skillssafe.com/api/mcp" } }

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/skillssafe-security-scanner?style=directory)](https://allmcps.com/mcp/skillssafe-security-scanner)

HTML Embed

<a href="https://allmcps.com/mcp/skillssafe-security-scanner"><img src="https://allmcps.com/api/badge/skillssafe-security-scanner?style=directory" alt="SkillsSafe Security Scanner on AllMCPs" /></a>

Technical Specs & Signals

CategorySecurity

6/8 checks healthy over the last 45d

35Quality signal: Fair · 35/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership10/20

Documentation & tools16/30

Adoption & activity0/15

Community engagement0/10

★ Featured

Moxie Docs MCP

MCP & Agent Skills for Automated Documentation, and codebase conventions + context

Explore Server →

Own this project?

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically and keep it verified as long as the badge stays live.

Claim & get free dofollow

Share & Embed

Add our SVG badge (dark/light directory styles) or embeddable widget to your site.