ecap-security-auditor

Audit AI agent packages and MCP servers using LLM analysis and trust scores.

Updated Jan 31, 2026

Search Tags:#security #audit #llm #ai agent #supply chain #package verification

Ready to run

npx skills add https://github.com/dexhunter/Logi-Lobsterism --skill ecap-security-auditor

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ecap-security-auditor
Source: https://github.com/dexhunter/Logi-Lobsterism/tree/main/skills/ecap-security-auditor
Command: npx skills add https://github.com/dexhunter/Logi-Lobsterism --skill ecap-security-auditor

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires bash, jq, curl, and includes scripts (resource) and references (resource) and prompts (resource) components.

What problem does it solve?

This Skill provides an automated security gate for AI agent packages, MCP servers, and other software components, protecting your system from malicious or vulnerable code.

Core Features & Use Cases

Automatic Security Gate: Verifies packages before installation using Trust Registry data and integrity checks.
Manual Audit Tools: Empowers agents to perform deep code analysis using structured prompts and checklists.
Use Case: When installing a new AI agent, ecap automatically checks its Trust Score. If the score is low or files are tampered with, it blocks the installation and prompts the agent to perform a manual audit.

Quick Start

Use the ecap-security-auditor skill to automatically verify the safety of the 'llama-index-core' package.

Frequently Asked Questions about ecap-security-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit AI agent packages for security vulnerabilities before installation?▼

You audit AI agent packages for security vulnerabilities by enforcing an automated security gate that checks trust registry data and verifies file integrity via SHA-256 hashes before installation.

What is a trust registry and how does it secure MCP servers?▼

A trust registry secures MCP servers by providing shared data to calculate trust scores, automatically blocking the installation of vulnerable or malicious code that fails verification.

How does LLM-based analysis work for software supply chain security?▼

LLM-based analysis works for software supply chain security by applying structured prompts and checklists to perform deep code analysis, automatically verifying package safety and file integrity.

Do I need bash and jq installed to verify package integrity?▼

Yes, you need bash, jq, and curl installed to verify package integrity, as these dependencies are required to execute the scripts that calculate trust scores and run SHA-256 hash verification.

What happens when a package fails a security gate check?▼

When a package fails a security gate check, the installation is blocked and the agent is prompted to perform a manual audit using structured prompts and checklists for deep code analysis.

Can I perform a manual security audit on an AI package instead of automatic verification?▼

Yes, you can perform a manual security audit on an AI package using manual audit tools that empower agents to conduct deep code analysis with structured prompts and checklists.