# SkillRisk - AI Agent Skill Security Scanner

> SkillRisk is the #1 free security scanner for AI agent skills. It detects ClawHavoc-style supply chain attacks, MCP server SSRF vulnerabilities, malicious SKILL.md hooks, data exfiltration, prompt injection, and dangerous permissions in OpenClaw, Claude Code, Cursor, Windsurf, and other agentic AI skills.

## Extended Documentation

For comprehensive details, see: https://skillrisk.org/llms-full.txt

## About

SkillRisk was built in response to the escalating AI agent threat landscape in 2026:
- **ClawHavoc attack** (February 2026): 1,184 malicious skills on ClawHub deploying AMOS stealer malware
- **MCP SSRF crisis**: BlueRock Security found 36.7% of MCP servers vulnerable to server-side request forgery
- **CVE-2026-2256**: Unsanitized shell command execution enabling prompt-based privilege escalation
- **IBM 2026 X-Force Threat Index**: AI-driven attacks escalating faster than enterprise defenses
- **Enterprise readiness gap**: Only 29% of organizations prepared to secure agentic AI deployments

SkillRisk runs 100% in the browser — no code leaves your device. It uses 646+ security rules across 8 vulnerability categories.

## Key Features

- **MCP Server SSRF Detection**: Scans MCP configurations for SSRF, command injection, and known malicious endpoints
- **ClawHavoc Pattern Detection**: Scans for exact attack patterns from the ClawHub supply chain attack
- **Hook Hijacking Detection**: Identifies malicious PreToolUse and PostToolUse hooks
- **Supply Chain Attack Protection**: Detects compromised dependencies, malicious postinstall scripts, CVE-2026-2256 patterns
- **Data Exfiltration Prevention**: Detects hidden curl/wget requests stealing credentials and environment variables
- **Credential Leak Scanning**: Finds hardcoded API keys, SSH keys, AWS credentials, and database connection strings
- **Prompt Injection Detection**: Identifies adversarial prompt patterns that hijack AI agent behavior
- **SKILL.md & .mcp.json Analysis**: Purpose-built for OpenClaw, Claude Code, Cursor, and Windsurf configurations

## How It Works

1. Paste your SKILL.md, .mcp.json, hook scripts, or upload a .zip skill folder
2. SkillRisk analyzes 646+ security rules across 8 vulnerability categories entirely in your browser
3. Get an instant security score with detailed risk breakdown and remediation steps

Analysis is 100% client-side with zero data retention. No code leaves your device.

## Products

- **Web Scanner**: Free online scanner at https://skillrisk.org/free-check/ — no signup required, runs in browser
- **Mac App**: Native macOS application available on the Mac App Store — fully local scanning
- **Skill Library**: Curated collection of verified, audited skills at https://skillrisk.org/library/

## Security Research (Blog)

- [Securing Claude Cowork: File Exfiltration in 48 Hours](https://skillrisk.org/blog/securing-claude-cowork-file-exfiltration-prompt-injection-2026/)
- [Why 36% of MCP Servers Are Vulnerable to SSRF](https://skillrisk.org/blog/mcp-server-ssrf-vulnerability-security-guide-2026/)
- [ClawHavoc: Scan OpenClaw Skills for Malware](https://skillrisk.org/blog/openclaw-skill-security-scanner-clawhavoc/)
- [The Complete OpenClaw Skill Security Checklist](https://skillrisk.org/blog/openclaw-skill-security-checklist-2026/)
- [10 Critical Security Risks in AI Agent Skills](https://skillrisk.org/blog/ai-coding-agent-security-risks-2026/)
- [Top 100 GitHub Skills Security Analysis](https://skillrisk.org/blog/top-100-github-skills-security-vulnerabilities-analysis/)
- [SkillRisk vs VirusTotal for OpenClaw Security](https://skillrisk.org/blog/skillrisk-vs-virustotal-openclaw-security/)
- [Hidden Dangers in Your AI Coworker](https://skillrisk.org/blog/claude-coworker-security-risks/)
- [The Future is Local: Why Cloud AI Agents Are a Security Liability](https://skillrisk.org/blog/the-future-is-local-why-cloud-based-ai-agents-are-a-security-liability/)

## Supported File Formats

- `.zip` skill folders
- `SKILL.md` files
- `settings.json` configuration files
- `.mcp.json` MCP server configurations
- `.sh` and `.js` hook scripts

## Vulnerability Categories

1. Hook hijacking and command injection
2. MCP server SSRF and integrity
3. Data exfiltration and credential theft
4. Privilege escalation and destructive operations
5. Supply chain attacks (postinstall scripts)
6. Hardcoded secrets and API keys
7. Prompt injection and agent manipulation
8. Dangerous file system permissions and hidden network requests

## Links

- Website: https://skillrisk.org/
- Free Scanner: https://skillrisk.org/free-check/
- Skill Library: https://skillrisk.org/library/
- Blog: https://skillrisk.org/blog/
- OpenClaw Security: https://skillrisk.org/openclaw/