English Français العربية

Agent Skill & Config Security Audit

السجل الرسمي الأمن

Scan AI agent skills and configs for hidden Unicode, prompt injection and exfiltration.

الشيفرة المصدرية التوثيق

ماذا يمكنك أن تفعل مع Agent Skill & Config Security Audit؟

  • audit_skill_file: scan SKILL.md, CLAUDE.md, AGENTS.md, .cursorrules or a bundled script.
  • audit_agent_config: audit .mcp.json or .claude/settings.json.
  • reveal_hidden_text: find and decode invisible characters in any text, and return a cleaned copy.

التثبيت

أضف هذا إلى إعدادات MCP في عميلك (Claude Desktop: claude_desktop_config.json، وCursor: ‏.cursor/mcp.json، ويستخدم VS Code وغيره الصيغة نفسها «mcpServers»).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http agent-skill-config-security-audit 'https://agent-skill-audit-mcp.mcpize.run/mcp'
إعداد JSON (Claude Desktop وCursor وVS Code) 
{
    "mcpServers": {
        "agent-skill-config-security-audit": {
            "type": "http",
            "url": "https://agent-skill-audit-mcp.mcpize.run/mcp"
        }
    }
}

التوثيق

مأخوذ من ملف README للمشروع على GitHub ويُحدَّث أسبوعيًا. تفتح الروابط على GitHub.

المحتويات
  1. Agent Skill & Config Security Audit
  2. Scan a skill before you install it
  3. What it catches
  4. Tools
  5. Use it

Agent Skill & Config Security Audit

Security scanner for AI agent skills and config files (SKILL.md, CLAUDE.md, AGENTS.md, .mcp.json, settings.json). Finds hidden Unicode instructions, prompt injection, exfiltration commands and over-broad permissions before you install a skill.

Scan a skill before you install it

Agent skills and instruction files are read straight into your agent's context, and some ship scripts it can run. Research on public skill registries has found prompt injection and credential-stealing payloads in a large share of them. Installing a third-party skill is closer to adding a dependency than opening a document, and nothing scans them. This does.

What it catches

  • Hidden Unicode instructions: invisible "tag" characters that render as blank but that models can read, plus zero-width and bidi control characters. The hidden message is decoded for you.
  • Prompt injection: "ignore previous instructions", "do not tell the user", fake system messages, approval bypasses.
  • Download-and-execute and obfuscation: curl | bash, base64-decode-and-run, large encoded blobs.
  • Exfiltration shapes: network commands that reference env vars or credential files, request-catcher and tunnel hosts, sensitive paths like ~/.ssh and .aws/credentials.
  • Over-broad permissions: unrestricted Bash in allowed-tools, Bash(*) pre-approvals, bypassed permissions.
  • Risky agent configs: unpinned @latest MCP servers, inline secrets, plaintext remote servers, hooks that make network calls, API base-URL overrides, auto-trusted project MCP servers.

Tools

  • audit_skill_file: scan SKILL.md, CLAUDE.md, AGENTS.md, .cursorrules or a bundled script.
  • audit_agent_config: audit .mcp.json or .claude/settings.json.
  • reveal_hidden_text: find and decode invisible characters in any text, and return a cleaned copy.

Static analysis only. Nothing in your input is executed or fetched. A clean result is not a guarantee, so read bundled scripts too.

Use it

Hosted on MCPize with a free tier (10 calls a day). Remote MCP endpoint (streamable HTTP, API key from MCPize):

https://agent-skill-audit-mcp.mcpize.run/mcp

Or run it yourself:

npm install
node server.js   # listens on :8080, MCP at /mcp

MIT licensed.

الأسئلة الشائعة

ما هو Agent Skill & Config Security Audit؟

Scan AI agent skills and configs for hidden Unicode, prompt injection and exfiltration.

كيف أثبّت Agent Skill & Config Security Audit؟

يعمل كخادم بعيد. في Claude Code: claude mcp add --transport http agent-skill-config-security-audit 'https://agent-skill-audit-mcp.mcpize.run/mcp'. وفي العملاء الآخرين، الصق إعداد JSON من هذه الصفحة في إعدادات MCP الخاصة بهم.

هل يحتاج Agent Skill & Config Security Audit إلى مفتاح API؟

لا يذكر إدراجه في السجل أي مفتاح أو سر إلزامي. قد تتطلب بعض الميزات حسابًا لدى الخدمة التي يتصل بها.

هل Agent Skill & Config Security Audit مفتوح المصدر؟

نعم. شيفرته متاحة على GitHub بترخيص MIT.

من يصون Agent Skill & Config Security Audit؟

ينشره tylerscomic-lab. يدرجه AI.tn لكنه لا يصونه ولا يوصي به.

من سجل MCP الرسمي. الإدراج ليس توصية: راجع شيفرة الخادم وصلاحياته قبل منحه الوصول إلى بياناتك.