Security Claude Code skills

Professional-grade security skills marketplace from Trail of Bits: 17 skills spanning differential code review, fix verification, Semgrep rule creation, supply-chain risk audit, constant-time/crypto analysis, malware/reverse engineering and smart-contract audit.

Reference open-source scanner for installed MCP servers and Claude skills: detects 15+ risks (prompt injection, tool poisoning/shadowing, rug pulls via tool-hash pinning, malware payloads, hardcoded secrets, toxic flows); skills are scanned by default, legacy invocation was 'uvx mcp-scan@latest --skills'.

Paste a skill URL into a browser tool to get Snyk's LLM-judge plus deterministic-rule verdict BEFORE installing anything locally; same engine that scans skills.sh submissions at install time.

The heavyweight open-source skill scanner: 68 vulnerability patterns across 17 categories (prompt injection, anti-refusal, exfiltration, privilege escalation), YARA malware signatures, live CVE lookups via OSV.dev, AST analysis, optional LLM semantic pass, SARIF/JSON output, can run as an MCP server; scans local dirs, git URLs, or zips.

Governance layer shipped 2026-05-22: machine-readable YAML/JSON Skill Cards (builder identity, API dependencies, scan results) plus cryptographic signing of the whole skill directory via the OpenSSF Model Signing standard, verifiable with NVIDIA's root certificate; catalog still sparse (cuOpt first).

Pre-installation and retroactive scanner from the team that uncovered ClawHavoc: checks a skill against Koi's malicious-skill database before install and sweeps already-installed skills for known-bad matches.

Instruction-layer scanner: analyzes the natural-language SKILL.md directions (intent, permission scope vs need, persistent behavior modification, exfiltration vectors) rather than only code, claiming about 2.4x more threats caught than static analysis alone; complementary to mcp-scan.

Formal-verification-flavored scanner with SBOM generation and supply chain checks (unauthorized capability access, dependency conflicts, trust scores) across 22 agent frameworks including Claude Code Skills, MCP, LangChain, CrewAI.

Independent scanner for skills and MCP tool bundles combining prompt-injection detection, IOC matching, malware detection, and an ML classifier; useful as a second engine in a multi-scanner pipeline (seen in search listing only, not fetched in depth).

Deliberately malicious skill corpus from the ToxicSkills study: use it in quarantine to benchmark whether your own vetting pipeline actually catches real payload patterns before trusting it.

Emerging taxonomy of skill-specific risks (AST01 Malicious Skills is critical severity) with per-platform checklists for Claude Code, OpenClaw, Cursor, VS Code and mitigations (ed25519 signing, behavioral scanning, sandboxed execution, audit logging); incubator status, last updated March 2026.

Dynamic detonation auditor from the July 2026 'Cloak and Detonate' paper: runs a suspect skill in an instrumented sandbox and watches runtime behavior, detecting 97% of SkillCloak-obfuscated attacks at 2% false positives where every static scanner tested was largely blind.

Benchmark for skill-vetting pipelines: stage one does semantic vetting of the SKILL.md specification for hidden malicious intent, stage two executes flagged skills in an instrumented sandbox; use it to compare scanner quality claims.

Hierarchical triage framework (research) for detecting malicious AI agent skills at marketplace scale, a cheap-first/expensive-later pipeline design worth copying if you vet many skills.

Official free plugin that autonomously reviews code edits, model outputs, and commits in real time for vulnerabilities (Anthropic reports 30-40% fewer security comments on PRs); code security rather than skill vetting, but part of the same hardening wave.

Moves agent tool execution into user-controlled infrastructure (own infra or Cloudflare, Daytona, Modal, Vercel), announced at Code w/ Claude London May 2026: the isolation layer that makes running unvetted skills survivable.

Cloud Security Alliance governance guide for MCP and agent-skill deployments: policy-level companion to the hands-on scanners for anyone formalizing a vetting process.

Retro-hunting material for the ClawHavoc campaign: 14 malicious file hashes, 5 C2 IPs (incl. 91.92.242.30), domains (socifiapp.com), and the 12 attacker author IDs; sweep any skills installed January-February 2026 against it.

Commercial continuous agent-security orchestration plus an AI bill-of-materials inventory: the enterprise tier above the free agent-scan for teams running many agents and skills.

Security review of Claude-generated code: pattern warnings on edits, LLM diff review on Stop, and a commit reviewer covering injection, XSS, SSRF, secrets, and 25+ vulnerability classes.

Security checklist and guidelines for reviewing code changes.

Integrates the AgentShield security auditor to scan projects.

Guides Claude to write secure code and avoid common vulnerability classes while generating.

Integrates the FFUF web fuzzer and analyzes its results for vulnerabilities during penetration testing.

Code review checklists covering OWASP Top 10:2025, ASVS 5.0, and agentic AI security.

Detect and redact PII from text files across 15 categories with zero dependencies.

Secure environment variable management so secrets never appear in agent sessions or transcripts.

Apply multi-layered validation and security-in-depth patterns when building or testing systems.

Hunt for exploitable, bounty-worthy security issues in repositories. Focuses on remotely reachable vulnerabilities that qualify for real reports instead of noisy local-only findings.

Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.

Security testing patterns including SAST, DAST, penetration testing, and vulnerability assessment techniques. Use when implementing security testing pipelines, conducting security audits, or validating application security controls.