Skill Audit Mcp
Statically scan MCP servers, agent skills, and plugins for malicious patterns before you add them to Claude Code or Cursor.
Overview
Skill Audit MCP is a MCP server for the Ship phase that statically scans MCP servers, agent skills, and plugins against 68 attack patterns before install.
What is this MCP server?
- Static security scanner aimed at MCP servers, agent skills, and plugins
- 68 documented attack patterns for extension supply-chain review
- Helps vet community skills before enabling them in production agents
- Stdio MCP via OCI ghcr.io/eltociear/skill-audit-mcp:mcp-1.0.2
- Complements manual README review when installing from directories or git
- 68 attack patterns cited in server description
- Server version 1.0.2
- Targets MCP servers, agent skills, and plugins
Community signal: 3 GitHub stars.
What problem does it solve?
Installing random agent skills and MCP servers is like adding unaudited binaries—solo builders lack time to manually hunt prompt injection, exfiltration, and tool-abuse patterns.
Who is it for?
Builders curating a personal skill stack from GitHub, marketplaces, or Skillselion who want agent-driven supply-chain review.
Skip if: Teams that only use first-party, internally authored skills with no third-party MCP, or groups needing live penetration tests and SOC monitoring.
What do I get? / Deliverables
You get pattern-based security findings on extensions so you can reject, quarantine, or harden skills before they touch production workflows.
- Static findings mapped to 68 attack-pattern categories
- Reviewable report on third-party MCP and skill packages
- Clearer install/no-install decisions for agent extensions
Recommended MCP Servers
Journey fit
How it compares
Static extension scanner MCP, not a runtime agent firewall or Skillselion catalog entry itself.
Common Questions / FAQ
Who is Skill Audit MCP for?
Solo developers and small teams adopting third-party MCP servers and skills who need repeatable static checks before enabling new tools.
When should I use Skill Audit MCP?
Use it when adding a skill from a repo, forking a marketplace package, or reviewing updates to plugins already in your agent config.
How do I add Skill Audit MCP to my agent?
Configure stdio MCP with image ghcr.io/eltociear/skill-audit-mcp:mcp-1.0.2 in your client settings, then invoke scan tools against skill or server directories.