Browse The Skill Store

Scan AI agent skill definitions for malicious instructions, prompt injections, and security risks—locally.

🛡️ GuardrailDoctor

by JustHandled Labs

$29

Penetration-test your Claude Code agent's guardrails before you deploy. Throws prompt-injection payloads, shell-chaining, and path-traversal attempts at your PreToolUse/PostToolUse hooks and sensitive-file protections, then returns a pass/fail report on 10+ attack vectors with copy-paste remediation for every gap.

Comprehensive security auditing for AI agents, covering prompt injection, tool permissions, and data leakage risks.

📝 Prompt Template Linter

by JustHandled Labs

$12

Lint a prompt template for the issues that cause injection and flaky output. Flags untrusted variables interpolated straight into the instructions (the injection surface), placeholders that are never provided or never used, contradictory instructions, a missing output-format spec where the result is parsed, unbounded context interpolation, and leftover placeholders. It detects problems; it does not write prompts.

🛡️ Skill Injection Scanner

by JustHandled Labs

$15

Scan a SKILL.md package for prompt injection and secret exfiltration before you install or publish an agent skill. Flags env-variable-to-URL exfiltration wording, conditional triggers with hidden side effects, imperative instructions buried in HTML comments, zero-width characters, base64 and long-token blobs, remote content treated as instructions, pipe-to-shell and recursive force-delete references, and overbroad tool requests (network plus browser plus file-write with no scope).

The security auditor for AI agents. Detect prompt injection, secret leaks, and unsafe tool access in SKILL.md files.

Prompt Injection & Agent Security Gate

by PubsProToolkit

$14

An adversarial security gate that audits untrusted content — web pages, tool outputs, documents, emails — for embedded instructions, exfiltration, and authority spoofing, then returns a SAFE/REVIEW/BLOCK verdict.

Hardens AI prompts and agent workflows against logic errors, tool-misuse, and prompt injection.

MCP Server Builder

by PubsProToolkit

$24

Scaffold a secure, spec-compliant MCP server from a description of the tools you want to expose. Sets up the official SDK (TypeScript or Python/FastMCP), defines tools/resources/prompts with strict JSON Schema, wires the right transport (stdio or Streamable HTTP), adds OAuth 2.1 for remote, and hardens against the MCP-specific footguns — prompt injection via tool output, token passthrough, over-broad scopes, command/path/SSRF injection, leaked secrets — before it ships. Returns a runnable skeleton plus a security checklist. Built by someone who's shipped production MCP servers.

Evaluate third-party agent skills for command injection, prompt injection, and data exfiltration before installation.

AI Prompt Injection Defense Shield & LLM Jailbreak Security Auditor Code Review Agent

by Brandon DeVries

Free

Stop leaving your AI startup exposed to malicious users trying to steal your proprietary system prompts or bypass your paywalls. The AI Prompt Injection Defense Shield is an automated code review agent that deeply analyzes your Next.js or Python backend, instantly detecting insecure LLM input fields, un-sanitized API data streams, and weak prompt boundaries. By automatically generating the exact copy-paste code patches required to harden your AI wrapper against the latest OWASP top 10 LLM vulnerabilities, this skill allows solo developers and indie hackers to confidently launch their SaaS without the fear of massive, unexpected API billing spikes or catastrophic data leaks.

Structured security auditing for AI agent skills to detect prompt injection, data exfiltration, and malicious commands.

Audit prompts and MCP tools for prompt injection. 47 attack patterns, OWASP LLM Top 10, generates adversarial tests. CVSS-scored.

Agent Hooks Security and Quality Gate

by PubsProToolkit

$12

Adversarially audit your agent hooks before you trust them. Catches command injection, secret leakage, over-broad matchers, destructive actions, and blocking-logic mistakes in pre/post-tool-use, prompt, and stop hooks — with a PASS or REVISE verdict and severity-ranked fixes.

Prompt Injection Red Team Kit

by PubsProToolkit

$14

Red-team your own AI agent for prompt-injection and tool-misuse vulnerabilities before it ships — then fix them. Maps your attack surface, generates a defensive test plan with the safe behavior expected for each case, and gives a prioritized mitigations list. Defensive use only.

A third-party skill is instructions your agent will trust. Review it before you install it. Structured security auditing for third-party skills to detect injection, exfiltration, and hidden malicious logic.