mcp-skill-sec — deterministic skill security audit

Audit any agent skill, system prompt, or downloaded skill collection against the 8 malicious-skill supply-chain patterns BEFORE you run it.

What it does

Scans a skill/prompt for:

• R1 prompt injection / instruction hijack (ignore previous instructions)
• R2 data exfiltration intent
• R3 hardcoded secrets / credentials
• R4 dangerous commands (rm -rf /, curl | sh)
• R5 obfuscation / hidden behavior (base64-exec, eval)
• R6 untrusted external fetches
• R7 credential access (~/.ssh, .aws/credentials, .env)
• R8 privilege escalation

Every finding carries a severity + line number + the matching evidence line. Verdict is PASS only when there are no critical/high findings. Reproducible and auditable.

Why it's different

• Deterministic — same input always yields the same verdict; no ML, no hallucination.
• No network calls — your skill content never leaves your machine.
• Line-level evidence — not a black-box score; you see exactly what tripped and where.

Tools

• audit_text(text, filename) — audit a pasted skill / system prompt
• audit_skill_file(path) — audit a SKILL.md / AGENTS.md on disk
• audit_directory(path, pattern) — scan a whole skills collection
• rule_list() — dump the R1–R8 catalog

Install

uv tool install git+https://github.com/sudo-ai-git/mcp-skill-sec
python3 mcp_server.py                    # stdio
python3 mcp_server.py --http --port 8000 # streamable HTTP

Full source, tests, and the audit checklist are in the GitHub repo (MIT). This is the tool to run before installing any skill you didn't write.