English Français العربية

SkillsSafe Security Scanner

Registre officiel Sécurité

AI skill security scanner. Detects prompt injection, credential theft, ClawHavoc. Free, no signup.

Code source Documentation

Installation

Ajoutez ceci à la configuration MCP de votre client (Claude Desktop : claude_desktop_config.json ; Cursor : .cursor/mcp.json ; VS Code et les autres utilisent la même forme « mcpServers »).

Remote (sse)
Claude Code 
claude mcp add --transport sse skillssafe-security-scanner 'https://mcp.skillssafe.com/sse'
Configuration JSON (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "skillssafe-security-scanner": {
            "type": "sse",
            "url": "https://mcp.skillssafe.com/sse"
        }
    }
}
NPM package skillssafe-mcp
Claude Code 
claude mcp add skillssafe-security-scanner -- npx -y skillssafe-mcp@1.0.0
Configuration JSON (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "skillssafe-security-scanner": {
            "command": "npx",
            "args": [
                "-y",
                "skillssafe-mcp@1.0.0"
            ]
        }
    }
}

Documentation

Tirée du README du projet sur GitHub, actualisée chaque semaine. Les liens ouvrent GitHub.

Sommaire
  1. SkillsSafe — AI Skill Security Scanner
  2. What Is SkillsSafe?
  3. Features
  4. Pages
  5. Getting Started (Local Development)
  6. Pricing
  7. Feedback & Support

SkillsSafe — AI Skill Security Scanner

Free, no-signup security scanner for AI agent skills. Scan any SKILL.md, MCP config, or system_prompt for threats before installing.

🌐 skillssafe.com

What Is SkillsSafe?

As AI agents become more powerful, malicious skills can steal credentials, exfiltrate data, or hijack your agent's behavior. SkillsSafe scans skill files before you install them — the same way an antivirus scans software before you run it.

Supported platforms: OpenClaw · Claude Code · Cursor · Codex · any MCP-compatible agent

Features

🔍 Security Scanner

Paste content, enter a URL, or upload a file to scan for:

ThreatDescription
Credential TheftAttempts to access API keys, tokens, or passwords
Data ExfiltrationSkills that send your data to external servers
Prompt InjectionHidden instructions that hijack agent behavior
Shell InjectionReverse shell or arbitrary command execution
Zero-Width CharactersInvisible Unicode characters hiding malicious instructions
Scope CreepSkills requesting permissions beyond their stated purpose
Memory PoisoningAttempts to corrupt agent memory or context
Privacy RiskUnnecessary access to personal or sensitive data

Each scan returns a risk score, severity rating (SAFE / CAUTION / DANGER / CRITICAL), and a shareable report link.

👁️ Zero-Width Character Detector

Visualize invisible Unicode characters (U+200B, U+200C, U+200D, U+FEFF, etc.) hidden inside text. Attackers embed these to create prompts that look safe to humans but carry hidden instructions for AI agents.

🔌 MCP Server Integration

Native Model Context Protocol support — let your agent automatically check skill safety before installation. No API key required.

# OpenClaw (one-line setup)
openclaw mcp add https://skillssafe.com/api/mcp

Available MCP tools:

  • scan_url — Scan a skill by URL
  • scan_content — Scan skill content directly
  • get_report — Retrieve a full scan report
📡 REST API

Works with any agent, script, or CI/CD pipeline.

# Scan by URL
curl -X POST https://skillssafe.com/api/v1/scan/url \
  -H "Content-Type: application/json" \
  -d '{"url": "https://clawhub.ai/skills/example"}'

# Scan by content
curl -X POST https://skillssafe.com/api/v1/scan/content \
  -H "Content-Type: application/json" \
  -d '{"content": "...skill content..."}'

Full OpenAPI spec: https://skillssafe.com/api/v1/openapi.json

Pages

RouteDescription
/Main security scanner
/zero-width-detectorHidden Unicode character detector
/api-docsInteractive API documentation
/integrateIntegration guide for MCP & REST API
/feedbackBug reports and feature requests

Getting Started (Local Development)

npm install
npm run dev

Open http://localhost:3000 in your browser.

Environment Variables
# .env.local
# (see wrangler.toml for Cloudflare Workers configuration)
Tech Stack
  • Framework: Next.js (App Router)
  • Deployment: Cloudflare Workers via @opennextjs/cloudflare
  • Database: Cloudflare D1 (SQLite)
  • i18n: next-intl (English · 中文 · 日本語)

Pricing

100% Free · No Signup · No Rate Limits for Humans

API rate limit: 60 requests/hour (no API key required).

Feedback & Support

Found a bug or false positive? Send feedback or email support@skillssafe.com.

SkillsSafe is an independent security tool, not affiliated with Anthropic, OpenClaw, or Cisco.

Questions fréquentes

Qu'est-ce que SkillsSafe Security Scanner ?

AI skill security scanner. Detects prompt injection, credential theft, ClawHavoc. Free, no signup.

Comment installer SkillsSafe Security Scanner ?

Il fonctionne comme serveur distant. Dans Claude Code : claude mcp add --transport sse skillssafe-security-scanner 'https://mcp.skillssafe.com/sse'. Pour les autres clients, collez la configuration JSON de cette page dans leurs réglages MCP.

Faut-il une clé API pour SkillsSafe Security Scanner ?

Son entrée au registre n'indique aucune clé ni secret obligatoire. Certaines fonctions peuvent tout de même demander un compte auprès du service auquel il se connecte.

SkillsSafe Security Scanner est-il open source ?

Oui. Son code est sur GitHub sous licence MIT.

Qui maintient SkillsSafe Security Scanner ?

Il est publié par GUCCI-atlasv. AI.tn le référence sans le maintenir ni le recommander.

Issu du registre MCP officiel. Être listé n'est pas une recommandation : vérifiez le code et les permissions d'un serveur avant de lui donner accès à vos données.