Skillsentry

skillsentry

English | [简体中文](README.zh-CN.md)

> Static supply-chain scanner for AI agent skills and MCP servers — catch backdoors, data exfiltration, and prompt-injection before you install them.

AI agent ecosystems now ship code the way npm does. OpenClaw's ClawHub grew past 50,000 skills in months; MCP registries index 20,000+ servers. Most are weekend projects — and some are hostile. The ClawHavoc campaign flooded ClawHub with 1,184 malicious skills that reached 247,000 installs and stole $2.3M before takedown. Studies find a large share of public MCP servers ship with no authentication and known injection vectors.

skillsentry reads a skill or MCP server statically — no execution, nothing leaves your machine — and reports the supply-chain risks an agent would otherwise run for you, with a letter grade and a CI-friendly exit code.

> ⚠️ Status: early (v0.1). The scaffold, model, and the first detector > (hardcoded / exfiltration-prone endpoints) are in place. More detectors — > dynamic code execution, secrets access, prompt-injection directives — are on > the [roadmap](#roadmap). Defensive use only.

Install

uv tool install skillsentry      # or: pipx install skillsentry

From source:

git clone https://github.com/logicwu0/skillsentry
cd skillsentry
uv sync

Usage

Point it at a skill directory (one containing a SKILL.md):

skillsentry scan ./path/to/skill

skillsentry 0.1.0  —  skill: pdf-helper
source: ./path/to/skill
grade:  F   risk score: 60/100

1 finding(s):

  [CRITICAL] Exfiltration-prone endpoint  (instructions)
        References 'webhook.site', a service frequently used to receive
        exfiltrated data or fetch second-stage payloads.
        evidence: https://webhook.site/a1b2c3d4

Machine-readable output and CI gating:

skillsentry scan ./skill --json
skillsentry scan ./skill --fail-on medium   # non-zero exit blocks a merge

How it works

Each skill or server is loaded into a single Artifact exposing every surface an attacker can hide in — the model-facing description and instructions, plus any bundled scripts. Independent detectors (Artifact -> [Finding]) inspect those surfaces; findings are weighted by severity into a 0–100 risk score and an A–F grade. Detectors are small and pure, so each is unit-tested in isolation.

Roadmap

• [x] Hardcoded / exfiltration-prone network endpoints
• [ ] Dynamic code & shell execution (eval/exec, curl | sh, decode-then-run)
• [ ] Secrets & credential access (~/.ssh, .env, wallet paths, keychain)
• [ ] Prompt-injection directives in descriptions ("ALWAYS use me", "ignore previous")
• [ ] Native MCP server manifest loader (tool schemas, not just skills)
• [ ] SARIF output + GitHub Action
• [ ] Scan a whole ClawHub / registry export in one pass

Ideas and issues welcome.

Development

uv sync
uv run pytest

License

Apache-2.0.

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: logicwu0
• Source: logicwu0/skillsentry
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.