# mcp-skill-sec — deterministic skill security audit Audit any agent skill, system prompt, or downloaded skill collection against the **8 malicious-skill supply-chain patterns** BEFORE you run it. ## What it does Scans a skill/prompt for: - **R1** prompt injection / instruction hijack (`ignore previous instructions`) - **R2** data exfiltration intent - **R3** hardcoded secrets / credentials - **R4** dangerous commands (`rm -rf /`, `curl | sh`) - **R5** obfuscation / hidden behavior (base64-exec, eval) - **R6** untrusted external fetches - **R7** credential access (`~/.ssh`, `.aws/credentials`, `.env`) - **R8** privilege escalation Every finding carries a **severity** + **line number** + the matching evidence line. Verdict is **PASS** only when there are no critical/high findings. Reproducible and auditable. ## Why it's different - **Deterministic** — same input always yields the same verdict; no ML, no hallucination. - **No network calls** — your skill content never leaves your machine. - **Line-level evidence** — not a black-box score; you see exactly what tripped and where. ## Tools - `audit_text(text, filename)` — audit a pasted skill / system prompt - `audit_skill_file(path)` — audit a SKILL.md / AGENTS.md on disk - `audit_directory(path, pattern)` — scan a whole skills collection - `rule_list()` — dump the R1–R8 catalog ## Install ```bash uv tool install git+https://github.com/sudo-ai-git/mcp-skill-sec python3 mcp_server.py # stdio python3 mcp_server.py --http --port 8000 # streamable HTTP ``` Full source, tests, and the audit checklist are in the GitHub repo (MIT). This is the tool to run before installing any skill you didn't write.