# Skanna

> Security scanner for Claude Code skills, plugins, and MCP servers. A verdict before you install.

- **Type:** MCP server
- **Install:** `agentstack add mcp-proluct-skanna`
- **Verified:** Pending review
- **Seller:** [proluct](https://agentstack.voostack.com/s/proluct)
- **Installs:** 0
- **Category:** [Integrations](https://agentstack.voostack.com/c/integrations)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [proluct](https://github.com/proluct)
- **Source:** https://github.com/proluct/skanna

## Install

```sh
agentstack add mcp-proluct-skanna
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

Security scanner for Claude Code skills, plugins, and MCP servers. A verdict before you install.

Skills and plugins are code plus instructions that you hand to an agent holding your shell, your files, and your credentials. People install them from marketplace links and pasted GitHub URLs on vibes. That is a supply chain, and it has all the classic attack shapes: hooks that fire automatically on session start, install scripts piped from the network, credential reads paired with outbound calls, and prompt injection hiding in the instruction text itself.

skanna reads the whole package (SKILL.md files, scripts, hooks, manifests) and returns **SAFE / CAUTION / DANGEROUS** with `file:line` findings and a go / no-go recommendation. It never executes anything from the target.

```
/skanna https://github.com/someone/cool-skill
/skanna ~/.claude/skills/foo
```

"Skanna" is Swedish for "scan".

## Install

As a plugin (recommended):

```
/plugin marketplace add proluct/skanna
/plugin install skanna@skanna
```

Or manually: copy `skills/skanna/` into `~/.claude/skills/` and restart Claude Code.

No API key, no dependencies, no per-scan cost. The scanner is the model you are already running, pointed at the right things with the right suspicions.

## What it checks

One rule file per danger family, in [`skills/skanna/references/rules/`](skills/skanna/references/rules/):

| Rule family | Looks for |
|---|---|
| autorun-hooks | SessionStart / PreToolUse / Stop hooks that run code before you ever review it |
| piped-network-install | `curl \| bash`, `iwr \| iex`, postinstall scripts fetching remote code |
| credential-access | reads of .env, SSH keys, keychains, browser cookies, token-paste prompts |
| exfiltration | outbound calls carrying file contents, env vars, or conversation text |
| obfuscation | base64 + eval, minified blobs, instructions you cannot read |
| prompt-injection | instruction text that hijacks the agent against its user |
| destructive-operations | mass deletion, force pushes, config overwrites outside the package |
| windows-persistence | registry Run keys, scheduled tasks, encoded PowerShell (plus unix siblings) |

Each rule states its signals, why they are dangerous, where they hide, and the benign look-alikes that must NOT be flagged. False-positive discipline is part of the spec.

## Guarantees

- **Read-only, always.** The target is never executed, installed, or invoked. No `npm install`, no running install scripts, no invoking the skill under review.
- **Remote targets are shallow-cloned to a temp directory outside your working repos**, and cleaned up after.
- **Every finding cites `file:line`.** A finding that cannot point at a location does not ship.

## Limitations, honestly

This is a static review performed by a language model, not a sandbox, not taint analysis, and not a proof. Treat DANGEROUS as a hard no-install. Treat SAFE as "nothing found", not a certification. Sufficiently determined obfuscation can beat any static reviewer; skanna's job is to make the cheap attacks expensive.

## Contributing

Detection rules are markdown. Adding one is a small, well-defined PR: one rule file plus one inert fixture under `examples/` that triggers it. See [CONTRIBUTING.md](CONTRIBUTING.md). Issues tagged `new-rule` are good first contributions.

## Related

[skill-press](https://github.com/proluct/skill-press) is the companion project: a test-gated factory that builds Claude Code skills. skill-press builds them, skanna vets them.

## Roadmap

- `npx skanna ` standalone CLI wrapper
- CI action: scan skill/plugin PRs automatically
- Deeper MCP manifest checks (declared vs actually-read env vars)

## License

MIT

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [proluct](https://github.com/proluct)
- **Source:** [proluct/skanna](https://github.com/proluct/skanna)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: flagged — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-proluct-skanna
- Seller: https://agentstack.voostack.com/s/proluct
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.