SkillShield

About SkillShield

SkillShield is a security-scanned directory of agent skills and MCP servers, built on the premise that AI extensions have become what browser extensions were a decade ago — except with direct system access. Every SKILL.md listed is scanned before it appears, for malicious code, prompt-injection payloads and general security vulnerabilities, and the vendor publishes the headline number driving the whole product: a scan across tens of thousands of AI extensions found a substantial fraction of community skills containing malicious code. The catalogue aggregates from six sources including ClawHub, SkillsMP, Skills.lc, the MCP Registry, MCPMarket and Awesome MCP, so it is a cross-registry view rather than another walled garden. There are three ways in. Browse the public directory for a trust score, issue summary and source context before you download anything. Install the local scanner (`npm install -g skillshield`, then `skillshield scan ./SKILL.md`) to check a file on your own machine before installing something sensitive. Or use the hosted registry CLI (`skillshield-cli`, exposing `skillshield-registry`) for quick lookups without a local scan setup — the docs are careful to keep the two CLI lanes separate. It also ships what it claims is the first MCP-server security scanner, checking for tool poisoning, over-permissioned access and prompt-injection vulnerabilities, plus a VS Code extension.

Key Features

Tags