Skip to content
Agentmart
Submit a tool

Agent Skill & Config Security Audit

Scan AI agent skills and configs for hidden Unicode, prompt injection and exfiltration.

Connector by tylerscomic-lab · GitHub account verified by the MCP Registry

IndexedMITRemote (HTTP)
Write a review

Install

Works with Claude Code, VS Code, Cursor, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install connector/tylerscomic-lab-agent-skill-audit-mcp

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Remote endpoint

  • https://agent-skill-audit-mcp.mcpize.run/mcp Remote (HTTP)

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

Scan AI agent skills and configs for hidden Unicode, prompt injection and exfiltration.

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools
2 read · 1 write · 0 delete
Secrets
None asked for
Install scripts
Nothing to install (hosted)
Runs as
Hosted (remote endpoint)

Tools by what they do 3

Read from the source code; the running server may list different tools.

Read 2 · Look things up without changing anything.

  • audit_agent_config
  • audit_skill_file

Write 1 · Create, change, send or run things.

  • reveal_hidden_text

Network hosts it talks to 1

  • agent-skill-audit-mcp.mcpize.run · found in remote endpoint, install command

Files it touches

  • Any path the agent passes to its tools

Tools (3)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • audit_agent_config

    Audits an agent config file given as JSON text (.mcp.json, .claude/settings.json, .claude/settings.local.json, Cursor/Windsurf MCP config) for unpinned @latest MCP servers, inline secrets, plaintext remote servers, pre-approved shell access, bypassed permissions, auto-trusted project MCP servers, hooks that make network calls, and API base-URL overrides. Run it on a repo before opening it with an agent.

  • audit_skill_file

    Scans the text of an AI agent skill or instruction file (SKILL.md, CLAUDE.md, AGENTS.md, .cursorrules, a bundled script) for hidden Unicode instructions, prompt-injection phrases, download-and-execute commands, base64 payloads, secret-exfiltration one-liners, destructive commands and over-broad allowed-tools. Run it on any third-party skill before installing. Static analysis only; nothing is executed or fetched.

  • reveal_hidden_text

    Finds invisible Unicode in text (zero-width, bidi controls, and the U+E0000 tag block used to smuggle hidden instructions), decodes any hidden ASCII message, and returns a cleaned copy with those characters removed.

Signals

Stars
0
Forks
0
Open issues
0
Last commit
Oct 1, 2026 (27 days ago)
Last release
Oct 1, 2026 (27 days ago)

From GitHub (fetched Oct 24, 2026).

Details

Registry name
io.github.tylerscomic-lab/agent-skill-audit-mcp
Version
1.0.0
Auth
Auth not stated
License
MIT
Repository
github.com/tylerscomic-lab/agent-skill-audit-mcp
First seen
Oct 24, 2026
Last checked
Oct 24, 2026
Source
Official MCP Registrygithub-graphql

More from tylerscomic-lab

Cite this page

Agent Skill & Config Security Audit MCP server. Agent Mart. https://agentmart.dev/connectors/tylerscomic-lab-agent-skill-audit-mcp (last updated 2026-10-24)