Skip to content
plugmcp
DirectorySkillsCategoriesBlog
EN/δΈ­ζ–‡
Sign inSign up
Home/Servers/SkillsSafe Security Scanner

SkillsSafe Security Scanner

by com.skillssafe

AI skill security scanner. Detects prompt injection, credential theft, ClawHavoc. Free, no signup.

Power your agent

Add this server

The publisher's own URL. Not a PlugMCP endpoint.

Server URL
https://mcp.skillssafe.com/sse
Provider
Add in Claude

Claude opens with the name and URL filled in. You still confirm it there.

Claude Code
claude mcp add --transport http com.skillssafe-scanner https://mcp.skillssafe.com/sse

Run in a terminal.

Claude Desktop
{
  "mcpServers": {
    "com.skillssafe-scanner": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://mcp.skillssafe.com/sse"
      ]
    }
  }
}

claude_desktop_config.json

Step-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Related MCP

View more
  • FirecrawlπŸ”₯ Official Firecrawl MCP Server - Adds powerful web scraping and search to Cursor, Claude and any other LLM clients.
  • N
    NotionToken-auth Notion MCP: pages, databases, blocks, comments, files. Runs headless in CI and agents.
  • Context7Context7 Platform -- Up-to-date code documentation for LLMs and AI code editors

Related skills

View all
  • reaReverse engineer anything with agents, from app behavior down to native binaries.
  • rea-changelog-updatePrepare or rewrite REA release changelogs and GitHub release notes from pinned Git history, with verified contributor thanks and Release Please synchronization.
  • rea-tool-designDesign or change REA investigation tools, CLI/MCP contracts, provider capabilities, and Evidence semantics.

AI skill security scanner. Detects prompt injection, credential theft, ClawHavoc. Free, no signup.

SkillsSafe β€” AI Skill Security Scanner

Free, no-signup security scanner for AI agent skills. Scan any SKILL.md, MCP config, or system_prompt for threats before installing.

🌐 skillssafe.com

What Is SkillsSafe?

As AI agents become more powerful, malicious skills can steal credentials, exfiltrate data, or hijack your agent's behavior. SkillsSafe scans skill files before you install them β€” the same way an antivirus scans software before you run it.

Supported platforms: OpenClaw Β· Claude Code Β· Cursor Β· Codex Β· any MCP-compatible agent

Features

πŸ” Security Scanner

Paste content, enter a URL, or upload a file to scan for:

ThreatDescription
Credential TheftAttempts to access API keys, tokens, or passwords
Data ExfiltrationSkills that send your data to external servers
Prompt InjectionHidden instructions that hijack agent behavior
Shell InjectionReverse shell or arbitrary command execution
Zero-Width CharactersInvisible Unicode characters hiding malicious instructions
Scope CreepSkills requesting permissions beyond their stated purpose
Memory PoisoningAttempts to corrupt agent memory or context
Privacy RiskUnnecessary access to personal or sensitive data

Each scan returns a risk score, severity rating (SAFE / CAUTION / DANGER / CRITICAL), and a shareable report link.

πŸ‘οΈ Zero-Width Character Detector

Visualize invisible Unicode characters (U+200B, U+200C, U+200D, U+FEFF, etc.) hidden inside text. Attackers embed these to create prompts that look safe to humans but carry hidden instructions for AI agents.

πŸ”Œ MCP Server Integration

Native Model Context Protocol support β€” let your agent automatically check skill safety before installation. No API key required.

# OpenClaw (one-line setup)
openclaw mcp add https://skillssafe.com/api/mcp

Available MCP tools:

  • scan_url β€” Scan a skill by URL
  • scan_content β€” Scan skill content directly
  • get_report β€” Retrieve a full scan report

πŸ“‘ REST API

Works with any agent, script, or CI/CD pipeline.

# Scan by URL
curl -X POST https://skillssafe.com/api/v1/scan/url \
  -H "Content-Type: application/json" \
  -d '{"url": "https://clawhub.ai/skills/example"}'

# Scan by content
curl -X POST https://skillssafe.com/api/v1/scan/content \
  -H "Content-Type: application/json" \
  -d '{"content": "...skill content..."}'

Full OpenAPI spec: https://skillssafe.com/api/v1/openapi.json

Pages

RouteDescription
/Main security scanner
/zero-width-detectorHidden Unicode character detector
/api-docsInteractive API documentation
/integrateIntegration guide for MCP & REST API
/feedbackBug reports and feature requests

Getting Started (Local Development)

npm install
npm run dev

Open http://localhost:3000 in your browser.

Environment Variables

# .env.local
# (see wrangler.toml for Cloudflare Workers configuration)

Tech Stack

  • Framework: Next.js (App Router)
  • Deployment: Cloudflare Workers via @opennextjs/cloudflare
  • Database: Cloudflare D1 (SQLite)
  • i18n: next-intl (English Β· δΈ­ζ–‡ Β· ζ—₯本θͺž)

Pricing

100% Free Β· No Signup Β· No Rate Limits for Humans

API rate limit: 60 requests/hour (no API key required).

Feedback & Support

Found a bug or false positive? Send feedback or email [email protected].

SkillsSafe is an independent security tool, not affiliated with Anthropic, OpenClaw, or Cisco.

How do I install SkillsSafe Security Scanner?
Copy the http config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.
Does SkillsSafe Security Scanner need an API key?
No required environment variable is listed on this record.
What transport does SkillsSafe Security Scanner use?
SkillsSafe Security Scanner is reached over HTTP.
When was SkillsSafe Security Scanner last checked?
Last checked 2026-10-16. AI skill security scanner. Detects prompt injection, credential theft, ClawHavoc. Free, no signup.

No tool list yet. Remote servers get one after the first health check.

plugmcp

Plug any tool into any agent. MCP servers for people who do not write servers. Gateway for volume, n8n for apps.

  • github.com/TODO
  • x.com/TODO
  • linkedin.com/company/TODO

PlugMCP, 2026

Product
  • Browse
  • Install
  • Host your own
  • Voice mode
  • Browser
Directory
  • All MCP servers
  • Agent skills
  • Categories
  • New
  • Voice
  • Submit a server
Developers
  • Docs
  • Blog
  • What is MCP
  • What is WebMCP
  • Status
Company
  • About
  • Contact
  • Terms
  • Privacy
  • DPA