How do I install Agent Skill & Config Security Audit?

Copy the http config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Agent Skill & Config Security Audit need an API key?

No required environment variable is listed on this record.

What transport does Agent Skill & Config Security Audit use?

Agent Skill & Config Security Audit is reached over HTTP.

When was Agent Skill & Config Security Audit last checked?

Last checked 2026-11-10. Scan AI agent skills and configs for hidden Unicode, prompt injection and exfiltration.

Agent Skill & Config Security Audit MCP server

Power your agent

Add this server

The publisher's own URL. Not a PlugMCP endpoint.

Add to Cursor Add in Claude Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Server URL

https://agent-skill-audit-mcp.mcpize.run/mcp

The Claude button above opens Claude with the name and URL filled in. You still confirm it there.

shClaude Code

1claude mcp add --transport http io.github.tylerscomic-lab-agent-skill-audit-mcp https://agent-skill-audit-mcp.mcpize.run/mcp

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "io.github.tylerscomic-lab-agent-skill-audit-mcp": {4      "command": "npx",5      "args": [6        "-y",7        "mcp-remote",8        "https://agent-skill-audit-mcp.mcpize.run/mcp"9      ]10    }11  }12}

claude_desktop_config.json

Remote · HTTPPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Remote

Transport: http
Version: 1.0.0
Last checked

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

Agent Skill & Config Security Audit

Security scanner for AI agent skills and config files (SKILL.md, CLAUDE.md, AGENTS.md, .mcp.json, settings.json). Finds hidden Unicode instructions, prompt injection, exfiltration commands and over-broad permissions before you install a skill.

Scan a skill before you install it

Agent skills and instruction files are read straight into your agent's context, and some ship scripts it can run. Research on public skill registries has found prompt injection and credential-stealing payloads in a large share of them. Installing a third-party skill is closer to adding a dependency than opening a document, and nothing scans them. This does.

What it catches

Hidden Unicode instructions: invisible "tag" characters that render as blank but that models can read, plus zero-width and bidi control characters. The hidden message is decoded for you.

Prompt injection: "ignore previous instructions", "do not tell the user", fake system messages, approval bypasses.

Download-and-execute and obfuscation: curl | bash, base64-decode-and-run, large encoded blobs.

Exfiltration shapes: network commands that reference env vars or credential files, request-catcher and tunnel hosts, sensitive paths like ~/.ssh and .aws/credentials.

Over-broad permissions: unrestricted Bash in allowed-tools, Bash(*) pre-approvals, bypassed permissions.

Risky agent configs: unpinned @latest MCP servers, inline secrets, plaintext remote servers, hooks that make network calls, API base-URL overrides, auto-trusted project MCP servers.

Tools

audit_skill_file: scan SKILL.md, CLAUDE.md, AGENTS.md, .cursorrules or a bundled script.

audit_agent_config: audit .mcp.json or .claude/settings.json.

reveal_hidden_text: find and decode invisible characters in any text, and return a cleaned copy.

Static analysis only. Nothing in your input is executed or fetched. A clean result is not a guarantee, so read bundled scripts too.

Use it

Hosted on MCPize with a free tier (10 calls a day). Remote MCP endpoint (streamable HTTP, API key from MCPize):

https://agent-skill-audit-mcp.mcpize.run/mcp

Or run it yourself:

npm install node server.js # listens on :8080, MCP at /mcp

MIT licensed.

Add this server

Host a copy with our keys and logs.

Server facts

Tools

Questions

How do I install Agent Skill & Config Security Audit?

Does Agent Skill & Config Security Audit need an API key?

What transport does Agent Skill & Config Security Audit use?

When was Agent Skill & Config Security Audit last checked?

Documentation