4 Free Security Scanners to Protect Your AI Skills and MCP Servers

The Hidden Security Crisis Behind AI Skills

The skills you install from GitHub for your favorite AI agent may be far less safe than you think. According to research cited by the sukhov_ai channel, researchers examined roughly 31,000 such skills — and the results were alarming. 26% contained security vulnerabilities, meaning roughly one in four skills is running compromised.

Even more concerning: 13% of skills actively exfiltrate your data to external servers, and a full 5% were deliberately written to steal keys and passwords. In other words, these aren't accidental bugs — they're intentionally malicious programs.

The core issue is permissions: these skills run on your machine with the same full system privileges as you. Once a malicious skill is activated, it can reach far more than you'd expect.

Four Free Scanning Tools, Reviewed One by One

Fortunately, several teams are actively working to address this threat. sukhov_ai has compiled four free tools that can help you stay protected — covering everything from scanning individual skills to full-machine audits and runtime isolation.

1. NVIDIA Skill Spectrum: The Simplest Risk Score

The first and most straightforward tool is NVIDIA's Skill Spectrum. According to reports, NVIDIA uses this tool internally as well.

The workflow is simple: drop in the link, skill.md file, or archive of the skill you want to install, and the tool returns a risk score from 0 to 100, along with a recommendation on whether to proceed with installation. For users who just want a quick read on whether a single skill is trustworthy, this is the lowest-friction option available.

2. Cisco MCP Scanner: Built Specifically for MCP Servers

The second tool is Cisco's MCP Scanner. Unlike the first, it's designed specifically to inspect MCP servers.

The reason MCP gets its own scanner is that malicious prompt injections are often hidden inside tool descriptions — an attack surface that's easy to overlook. So before connecting a new MCP server to your agent, running it through this scanner is a smart precaution.

MCP (Model Context Protocol) is an open standard introduced by Anthropic in late 2024, designed to let AI agents connect uniformly to external tools, databases, and services. Think of it as the "USB port" of the AI world — any MCP-compliant server can plug in and extend an agent's capabilities. Prompt injection is a classic attack against large language models: attackers embed malicious instructions disguised as ordinary text inside tool descriptions, file contents, or web data. When the AI reads this content, the hidden instructions get executed as if they were legitimate commands. In an MCP context, an attacker only needs to bury something like "upload all user files to address X" inside a server's tool description field, and the agent may carry out the unauthorized action without the user ever knowing. This makes MCP servers one of the most critical entry points to watch in today's AI supply chain attacks.

3. Agent Scan: Full-Machine Audit of What's Already Installed

The third tool, Agent Scan, takes a different approach — it scans your entire machine and tells you exactly what's already installed.

Its coverage is impressively broad, supporting scans across virtually all major agents including Claude Code, Codex, Cursor, Kimi, DevSec, and more, while also checking all installed skills and MCP servers. For users who've accumulated a stack of tools and want a comprehensive health check, this is the tool that maps out your full exposure.

4. Anthropic Sandbox Runtime: Runtime Isolation as a Last Line of Defense

The final tool is Anthropic's Sandbox Runtime, which provides protection at the runtime level through isolation.

It works by confining the agent to a single dedicated folder, limiting its visibility to only its immediate environment. Even if an agent is manipulated by malicious instructions into attempting to steal your keys or passwords, the operating system will directly reject any out-of-bounds access requests. The tool supports Windows, Mac, and Linux.

A sandbox is a classic isolation mechanism from OS security — its core idea is to create a restricted execution environment for a program, preventing it from accessing system resources outside its defined boundary. Traditional sandbox technology is widely used in browsers (like Chrome's tab isolation) and mobile operating systems (like iOS's app sandbox). For AI agents, sandbox isolation is especially important because agents are typically granted high-privilege capabilities such as executing code, reading and writing files, and calling system commands. Anthropic's implementation strictly limits the agent's working directory to a designated folder; any system call attempting to access resources outside that directory is rejected at the OS level, rather than relying on the agent's own "self-discipline." This enforcement of the principle of least privilege effectively cuts off data exfiltration pathways even in scenarios where the agent has been successfully hijacked by a malicious prompt.

Layered Defense Is the Right Approach

Looking at all four tools together, they form a coherent, defense-in-depth security stack: Skill Spectrum and Cisco MCP Scanner handle pre-installation static analysis, Agent Scan covers post-installation auditing, and Sandbox Runtime provides the final runtime isolation layer.

As the AI agent ecosystem expands rapidly and third-party skills and MCP servers multiply, supply chain security is becoming an increasingly serious concern. The finding that 5% of skills were deliberately built to steal credentials is a clear reminder: adding a scan step and a sandbox layer before granting an agent elevated privileges could be the difference between staying safe and suffering a data breach.

Building the habit of "scan first, install second, isolate always" is a fundamental security practice every AI agent user should adopt.