Plugin

skill-security-check

Security audit plugin that scans Claude Code skills, hooks, and MCP configurations for threats. Detects 37 attack patterns including prompt injection, data exfiltration, supply chain attacks (ToxicSkills/ClawHavoc), credential theft, reverse shells, backdoor persistence, API endpoint hijacking, Unicode homoglyph attacks, and context window poisoning. Includes runtime hooks for Bash command validation and MCP response inspection.

• Published source
• Repository

Analysed

12 October 2026

Last observed

13 October 2026

What the code does

• Runs shell commands Code that starts system commands on the machine it runs on.
• Downloads and runs code Code that fetches a script and pipes it into a shell.
• Runs hooks automatically Hooks that execute without being called explicitly.
• Runs an AI coding agent unsupervised Code that starts an AI coding agent with its approval prompts switched off.

Having a capability is not wrongdoing; many tools need these to do their job. It tells you what to check before you install.

This is public metadata, not a safety certification or complete assessment. Static analysis cannot establish what a tool does at runtime.