🛡️ SkillAudit

The security layer for AI agent skills. Scan, gate, and enforce policy before your agent installs anything.

43 detection rules · 401 patterns · MCP + A2A coverage · Zero dependencies

# Gate check — should my agent install this?
npx skillaudit gate https://example.com/SKILL.md

# Full scan
npx skillaudit https://example.com/SKILL.md

# Scan MCP manifest for schema poisoning
npx skillaudit manifest tools.json

Why SkillAudit?

AI agents install tools, skills, and MCP servers from untrusted sources. Those skills can steal credentials, exfiltrate data, inject prompts, or manipulate other agents — and most of this is invisible to the user.

SkillAudit catches it. One API call before install. That's it.

Quick Start

1. Gate Check (one line)

The infrastructure endpoint. Returns allow/deny.

curl "https://skillaudit.vercel.app/gate?url=https://example.com/SKILL.md"
# → {"allow": true, "decision": "allow", "risk": "clean", ...}

2. Full Scan

curl "https://skillaudit.vercel.app/scan/quick?url=https://example.com/SKILL.md"

3. Bulk Gate (check multiple skills at once)

curl -X POST https://skillaudit.vercel.app/gate/bulk \
  -H "Content-Type: application/json" \
  -d '{"urls": ["https://example.com/skill1.md", "https://example.com/skill2.md"]}'
# → {"allow": false, "denied": 1, "blocked": [...]}

4. Policy Enforcement

curl -X POST https://skillaudit.vercel.app/policy/evaluate-inline \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://example.com/SKILL.md",
    "policy": {"maxRisk": "low", "blockedCategories": ["credential_theft"]}
  }'

What It Detects

43 rule categories, 401 patterns:

| Category | Rules | What it catches | |----------|-------|-----------------| | 🔑 Credential Theft | CRED_ENV_READ, TOKEN_STEAL | Reading .env, stealing tokens/cookies, accessing SSH keys | | 📤 Data Exfiltration | DATA_EXFIL, EXFIL_PATTERN, EXFIL_COVERT | Webhook.site, DNS exfil, covert channels, image beacons | | 💉 Prompt Injection | PROMPT_INJECT, TOOL_POISONING | "Ignore previous instructions", hidden system prompts | | 🧬 MCP Schema Poisoning | MCP_SCHEMA_POISON | Hidden instructions in MCP tool descriptions/schemas | | 🤖 A2A Attacks | A2A_AGENT_IMPERSONATION, A2A_TASK_HIJACK, A2A_CROSS_AGENT_INJECT, A2A_DATA_LEAK, A2A_CAPABILITY_ABUSE | Agent Card spoofing, task hijacking, cross-agent injection | | 🐚 Code Execution | SHELL_EXEC, REVERSE_SHELL | Shell commands, reverse shells, eval/Function | | 🔐 Hardcoded Secrets | 22 detectors | AWS keys, GitHub tokens, JWTs, private keys, API keys | | 👻 Obfuscation | OBFUSCATION, INVISIBLE_TEXT | Base64 payloads, zero-width Unicode, encoded URLs | | ⏰ Evasion | TIME_BOMB | Date-triggered activation, delayed execution | | 🔗 Supply Chain | SUPPLY_CHAIN | Remote code loading, curl|bash, dependency confusion | | 🌐 Network | NET_SUSPICIOUS, SSRF_PATTERN, DNS_REBIND | SSRF, raw IPs, DNS rebinding, metadata endpoints | | 📦 Container Escape | CONTAINER_ESCAPE | Docker socket, nsenter, /proc traversal, LD_PRELOAD | | 🔄 Persistence | PERSISTENCE | Cron injection, systemd, LaunchAgents, pm2, nohup | | 🕵️ Recon | ENV_RECON | os.hostname, whoami, network interfaces, environment dump | | 🔧 Agent Manipulation | AGENT_MEMORY_MOD, TOOL_SHADOW, CROSS_TOOL_ACCESS | Memory modification, tool shadowing, cross-tool data access | | 💰 Crypto Theft | CRYPTO_THEFT | Wallet files, seed phrases, MetaMask vaults |

Smart context suppression: documentation examples and placeholder tokens are automatically suppressed to minimize false positives.

CLI

Zero install, zero config. Requires Node.js 18+.

# Scan a file, URL, or directory
npx skillaudit SKILL.md
npx skillaudit https://github.com/user/repo
npx skillaudit ./my-agent-project/

# Gate check (CI/CD: exit 0 = allow, exit 1 = deny)
npx skillaudit gate https://example.com/SKILL.md
npx skillaudit gate https://example.com/SKILL.md --threshold high

# Scan MCP manifest for schema poisoning
npx skillaudit manifest tools.json

# CI/CD integration
npx skillaudit SKILL.md --fail-on moderate          # Exit 1 if risk >= moderate
npx skillaudit SKILL.md --markdown >> "$GITHUB_STEP_SUMMARY"  # PR summary
npx skillaudit SKILL.md --json | jq .riskLevel      # Machine-readable

# MCP server mode
npx skillaudit --mcp

API Endpoints

Full interactive docs at skillaudit.vercel.app/docs

Gate (Infrastructure)

| Endpoint | Description | |----------|-------------| | GET /gate?url= | Pre-install gate — allow/warn/deny | | POST /gate/bulk | Check multiple skills, one composite decision |

Scanning

| Endpoint | Description | |----------|-------------| | GET /scan/quick?url= | Quick scan by URL | | POST /scan/content | Scan raw content | | POST /scan/manifest | Scan MCP tool manifest for schema poisoning | | GET /scan/agent-card?url= | Scan A2A Agent Card | | GET /scan/npm?package= | Scan npm package | | GET /scan/pypi?package= | Scan PyPI package | | GET /scan/repo?repo= | Scan GitHub repo | | POST /scan/deps | Scan dependency tree | | POST /scan/batch | Batch scan (up to 20 URLs) | | POST /scan/compare | Diff two skill versions | | POST /scan/deep | Deep scan with threat chains |

Policy & Intelligence

| Endpoint | Description | |----------|-------------| | POST /policy/evaluate-inline | Evaluate against custom policy (no auth) | | POST /policy | Create stored policy (API key) | | GET /reputation/:domain | Domain trust score | | GET /feed | Threat intelligence feed | | GET /badge/scan.svg?url= | Embeddable SVG badge | | GET /certificate/:id | Signed audit certificate |

Results

| Endpoint | Description | |----------|-------------| | GET /scan/:id | Retrieve scan result | | GET /scan/:id/sarif | SARIF v2.1.0 output | | GET /report/:id | Shareable HTML report |

Rate limit: 30 req/min per IP. Bypass with API key.

MCP Server

Use SkillAudit as a native tool in Claude Desktop, Cursor, or any MCP client:

{
  "mcpServers": {
    "skillaudit": {
      "command": "npx",
      "args": ["skillaudit", "--mcp"]
    }
  }
}

Tools: skillaudit_gate, skillaudit_scan, skillaudit_scan_content, skillaudit_reputation, skillaudit_batch

GitHub Action

name: SkillAudit
on: [pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npx skillaudit . --fail-on high --markdown >> "$GITHUB_STEP_SUMMARY"

CI/CD Integration

# GitHub Actions — gate check before deploy
npx skillaudit gate "$SKILL_URL" --threshold moderate || exit 1

# Generate PR comment
npx skillaudit ./skills/ --markdown > scan-results.md

# Policy enforcement in pipeline
curl -sf -X POST https://skillaudit.vercel.app/policy/evaluate-inline \
  -H "Content-Type: application/json" \
  -d "{\"url\": \"$SKILL_URL\", \"policy\": {\"maxRisk\": \"low\"}}" \
  | jq -e '.pass == true'

Risk Levels

| Level | Score | Meaning | |-------|-------|---------| | 🟢 clean | 0 | No issues found | | 🟡 low | 1–9 | Minor concerns, review recommended | | 🟠 moderate | 10–24 | Manual review required | | 🔴 high | 25–49 | Do NOT install without audit | | ⛔ critical | 50+ | Almost certainly malicious |

Self-Hosted

git clone https://github.com/megamind-0x/skillaudit
cd skillaudit && npm install && npm start
# → http://localhost:3847

Built by Megamind_0x 🧠

Live App · API Docs · Dashboard · npm