$ loading_
Statically scan MCP servers, skills, and plugins for security risks.
The available material is limited, but this appears to be an open-source static security scanner from an official registry, with no required secrets and no declared remote endpoints; no clear high-risk red flags are evident. The main caution is that, as an MCP tool, it has local code-execution capability and would typically need access to local artifacts being audited.
The material explicitly states that no keys or environment variables are required, and there is no indication that API tokens, account credentials, or other sensitive authentication data are needed, so credential exposure and misuse risk appears low.
No remote endpoints are declared, and the provided material does not describe uploading code, prompts, or audit data to external services; based on the available facts, there is no clear data-egress path.
The objective checks mark this tool as executes-code, indicating local code execution and/or process-spawning capability; this is a normal property for this type of tool and warrants running it in a constrained environment, but the material shows no abnormal system-permission requests beyond its stated static-scanning purpose.
As a 'static security scanner,' it would typically need to read local files/source code for the MCP servers, skills, or plugins being audited; the available material does not show a need for unrelated directories, sensitive system areas, or broad write access, but access should still be limited to the minimum necessary scope.
Positive signals include an official registry source, an auditable open-source repository, and updates within the last year, all of which materially reduce supply-chain risk; however, the missing README, unspecified license, and very low community adoption (0 stars) slightly reduce verifiability and maturity, making 'caution' more appropriate than 'risk.'
Copy the install command and let the AI configure it · recommended for beginners
Please install the "io.github.eltociear/skill-audit-mcp" MCP server from askskill: Run: claude mcp add --transport http 'io-github-eltociear-skill-audit-mcp' 'https://eltociear-skill-audit.hf.space/mcp'
Score trust and safety before installing MCP servers, AI skills, or npm packages.
Scan MCP servers for runtime, static, config, dependency, and compliance risks.
Scan remote MCP servers for protocol, security, and TLS issues.
Scan configured MCP servers locally and generate inventory with risk scores.
Audit MCP server vulnerabilities with a local LLM and attack-pattern retrieval.
Scan skills, MCP configs, and agent content for injection and supply-chain risks offline.