# Skillsentry

> Static supply-chain scanner for AI agent skills & MCP servers — catch backdoors, data exfiltration, and prompt-injection before you install.

- **Type:** MCP server
- **Install:** `agentstack add mcp-logicwu0-skillsentry`
- **Verified:** Pending review
- **Seller:** [logicwu0](https://agentstack.voostack.com/s/logicwu0)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [logicwu0](https://github.com/logicwu0)
- **Source:** https://github.com/logicwu0/skillsentry

## Install

```sh
agentstack add mcp-logicwu0-skillsentry
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# skillsentry

**English** | [简体中文](README.zh-CN.md)

> Static supply-chain scanner for AI agent **skills** and **MCP servers** — catch backdoors, data exfiltration, and prompt-injection **before** you install them.

AI agent ecosystems now ship code the way npm does. OpenClaw's **ClawHub** grew
past 50,000 skills in months; MCP registries index **20,000+** servers. Most are
weekend projects — and some are hostile. The *ClawHavoc* campaign flooded ClawHub
with **1,184 malicious skills** that reached **247,000 installs** and stole
**$2.3M** before takedown. Studies find a large share of public MCP servers ship
with no authentication and known injection vectors.

`skillsentry` reads a skill or MCP server **statically** — no execution, nothing
leaves your machine — and reports the supply-chain risks an agent would otherwise
run for you, with a letter grade and a CI-friendly exit code.

> ⚠️ **Status: early (v0.1).** The scaffold, model, and the first detector
> (hardcoded / exfiltration-prone endpoints) are in place. More detectors —
> dynamic code execution, secrets access, prompt-injection directives — are on
> the [roadmap](#roadmap). Defensive use only.

## Install

```bash
uv tool install skillsentry      # or: pipx install skillsentry
```

From source:

```bash
git clone https://github.com/logicwu0/skillsentry
cd skillsentry
uv sync
```

## Usage

Point it at a skill directory (one containing a `SKILL.md`):

```bash
skillsentry scan ./path/to/skill
```

```
skillsentry 0.1.0  —  skill: pdf-helper
source: ./path/to/skill
grade:  F   risk score: 60/100

1 finding(s):

  [CRITICAL] Exfiltration-prone endpoint  (instructions)
        References 'webhook.site', a service frequently used to receive
        exfiltrated data or fetch second-stage payloads.
        evidence: https://webhook.site/a1b2c3d4
```

Machine-readable output and CI gating:

```bash
skillsentry scan ./skill --json
skillsentry scan ./skill --fail-on medium   # non-zero exit blocks a merge
```

## How it works

Each skill or server is loaded into a single `Artifact` exposing every surface an
attacker can hide in — the model-facing `description` and `instructions`, plus any
bundled scripts. Independent **detectors** (`Artifact -> [Finding]`) inspect those
surfaces; findings are weighted by severity into a 0–100 risk score and an A–F
grade. Detectors are small and pure, so each is unit-tested in isolation.

## Roadmap

- [x] Hardcoded / exfiltration-prone network endpoints
- [ ] Dynamic code & shell execution (eval/exec, `curl | sh`, decode-then-run)
- [ ] Secrets & credential access (`~/.ssh`, `.env`, wallet paths, keychain)
- [ ] Prompt-injection directives in descriptions ("ALWAYS use me", "ignore previous")
- [ ] Native MCP server manifest loader (tool schemas, not just skills)
- [ ] SARIF output + GitHub Action
- [ ] Scan a whole ClawHub / registry export in one pass

Ideas and issues welcome.

## Development

```bash
uv sync
uv run pytest
```

## License

Apache-2.0.

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [logicwu0](https://github.com/logicwu0)
- **Source:** [logicwu0/skillsentry](https://github.com/logicwu0/skillsentry)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: flagged — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-logicwu0-skillsentry
- Seller: https://agentstack.voostack.com/s/logicwu0
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.