Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
SkillsSafe — AI Skill Security Scanner
Free, no-signup security scanner for AI agent skills. Scan any SKILL.md, MCP config, or system_prompt for threats before installing.
🌐 [skillssafe.com](https://skillssafe.com)
What Is SkillsSafe?
As AI agents become more powerful, malicious skills can steal credentials, exfiltrate data, or hijack your agent's behavior. SkillsSafe scans skill files before you install them — the same way an antivirus scans software before you run it.
Supported platforms: OpenClaw · Claude Code · Cursor · Codex · any MCP-compatible agent
Features
🔍 Security Scanner
Paste content, enter a URL, or upload a file to scan for:
| Threat | Description |
|---|---|
| Credential Theft | Attempts to access API keys, tokens, or passwords |
| Data Exfiltration | Skills that send your data to external servers |
| Prompt Injection | Hidden instructions that hijack agent behavior |
| Shell Injection | Reverse shell or arbitrary command execution |
| Zero-Width Characters | Invisible Unicode characters hiding malicious instructions |
| Scope Creep | Skills requesting permissions beyond their stated purpose |
| Memory Poisoning | Attempts to corrupt agent memory or context |
| Privacy Risk | Unnecessary access to personal or sensitive data |
Each scan returns a risk score, severity rating (SAFE / CAUTION / DANGER / CRITICAL), and a shareable report link.
👁️ Zero-Width Character Detector
Visualize invisible Unicode characters (U+200B, U+200C, U+200D, U+FEFF, etc.) hidden inside text. Attackers embed these to create prompts that look safe to humans but carry hidden instructions for AI agents.
🔌 MCP Server Integration
Native Model Context Protocol support — let your agent automatically check skill safety before installation. No API key required.
# OpenClaw (one-line setup)
openclaw mcp add https://skillssafe.com/api/mcpAvailable MCP tools:
scan_url— Scan a skill by URLscan_content— Scan skill content directlyget_report— Retrieve a full scan report
📡 REST API
Works with any agent, script, or CI/CD pipeline.
# Scan by URL
curl -X POST https://skillssafe.com/api/v1/scan/url \
-H "Content-Type: application/json" \
-d '{"url": "https://clawhub.ai/skills/example"}'
# Scan by content
curl -X POST https://skillssafe.com/api/v1/scan/content \
-H "Content-Type: application/json" \
-d '{"content": "...skill content..."}'Full OpenAPI spec: https://skillssafe.com/api/v1/openapi.json
Pages
| Route | Description |
|---|---|
/ | Main security scanner |
/zero-width-detector | Hidden Unicode character detector |
/api-docs | Interactive API documentation |
/integrate | Integration guide for MCP & REST API |
/feedback | Bug reports and feature requests |
Getting Started (Local Development)
npm install
npm run devOpen http://localhost:3000 in your browser.
Environment Variables
# .env.local
# (see wrangler.toml for Cloudflare Workers configuration)Tech Stack
- Framework: Next.js (App Router)
- Deployment: Cloudflare Workers via
@opennextjs/cloudflare - Database: Cloudflare D1 (SQLite)
- i18n: next-intl (English · 中文 · 日本語)
Pricing
100% Free · No Signup · No Rate Limits for Humans
API rate limit: 60 requests/hour (no API key required).
Feedback & Support
Found a bug or false positive? Send feedback or email [email protected].
SkillsSafe is an independent security tool, not affiliated with Anthropic, OpenClaw, or Cisco.