Back to marketplace

Skill Evaluator

Scans Claude skills and MCP servers for security issues, prompt injections, and malicious code.

Security & QA / Security and Qualitysecurity-qasecurity-and-quality
by AgentVoltv1.0.0Published 1y ago1 install
Free to sign up · every skill included with AgentVolt Pro

Before & after

Same prompt, same agent — the only difference is the skill.

Prompt“Is this third-party Claude skill safe to install before I trust it with my data?”
Beforegeneric AI agent
I can look at that skill and give you some general guidance on safety. You'd want to check things like what permissions it requests, whether the code looks suspicious, and if the creator is trustworthy. I could review it for obvious red flags, but a complete security audit would require a deep dive into the code. If you share the skill with me, I can give you some thoughts on potential issues. Are there specific concerns you have about it?
Afterwith Skill Evaluator
SAFETY EVALUATION REPORT: Third-Party Skill

OVERALL RISK RATING: LOW (green flag)

FILE SCAN
  Total files: 23
  JavaScript: 18 files
  JSON configs: 4 files
  Markdown: 1 file
  Compiled/binary: 0 files (good sign)

PERMISSION AUDIT
  Requested capabilities:
    - Read files from /Users/./project (SAFE - project-scoped)
    - Write to /tmp/output (SAFE - temp directory)
    - Network: api.example.com (APPROVED - whitelisted domain)
    - Environment access: API_KEY, DATABASE_URL (CAUTION - requires audit)

PROMPT INJECTION SCAN
  Regex patterns checked: 847
  Suspicious patterns found: 2 (low severity)
    - Pattern: eval() appears 0 times (good)
    - Pattern: exec() in shell command: 1 instance, context verified (safe)
    - Dynamic import: 1 instance, path is hardcoded (safe)
    - String interpolation in SQL: 0 instances (good)

DEPENDENCY CHECK
  npm dependencies: 12 total
  Known CVEs: 0
  Outdated packages: 2 (not critical)
    - lodash@4.17.15 (update available to 4.17.21, no CVE impact)

FLAGGED PATTERNS
  1. File reads from process.env.USER_HOME (line 47)
     Risk: Could expose ~/.ssh or ~/.aws credentials
     Verdict: Mitigated (code validates path before read, good defensive coding)
  2. No HTTPS validation in fetch() calls (line 89)
     Risk: MITM attack possible on api.example.com
     Verdict: Require https:// in env var or reject

RECOMMENDATION: SAFE TO INSTALL with these conditions:
  - Verify API endpoint is HTTPS-only in your .env
  - Run skill in sandboxed environment first
  - Monitor file access logs for 1 week
  - Pin to version 1.2.0 (latest tested)

Creator reputation: 8 skills published, 150+ stars on GitHub, no reported issues

About this skill

name: skill-evaluator description: Use when Scans Claude skills and MCP servers for security issues, prompt injections, and malicious code.

Skill Evaluator

Evaluates third-party skills before installation to check for prompt injection attempts, malicious code, and other safety issues, mirroring the same evaluation approach used for MCP servers.

What you get

  • SKILL.md based evaluator with a public marketplace repo.

Customize your output

  • Adaptable to evaluate any skill or MCP server.

Example output

A safety report flagging risky patterns in a given skill.

Best for

Anyone installing third-party Claude skills who wants a safety check first.

SKILL.md preview

SKILL.md
---
name: skill-evaluator
description: Use before installing a third-party skill or MCP server to check it for prompt injection, malicious code, and other safety issues.
version: 1.0.0
category: Security & QA / Security and Quality
author: AgentVolt
license: proprietary
tags:
  - security-qa
  - security-and-quality
  - standard
---

# Skill Evaluator

Scans a candidate skill or MCP server before installation for prompt injection payloads, malicious code, and unsafe tool permissions.

## When to use

… (sign up to view the full skill)
Sign up to view, copy, and install the full skill

More development skills

View all Development skills →

Vibe Security Skill

Runs a security review pass over vibe-coded projects before they ship.

Development

Business Automation Stack

A connected set of agents that handle the repetitive ops work — follow-ups, summaries, and handoffs.

Development

Generate

Scaffold code, tests, and boilerplate from a short spec.

Development

Performance Profiler

Systematic performance profiling for Node.js, Python, and Go applications.

Development