Scan GitHub and SkillsMP skills for threats before installation.
npx skills add https://github.com/adityasugandhi/skillsync-mcp --skill skillsync-mcp
Please help me install this Agent Skill. Skill: skillsync-mcp Source: https://github.com/adityasugandhi/skillsync-mcp/tree/main Command: npx skills add https://github.com/adityasugandhi/skillsync-mcp --skill skillsync-mcp
SkillSync MCP solves the risk of installing untrusted Claude Code/AI coding assistant skills by forcing a full security scan of GitHub skill content before installation.
Ask your AI assistant to install a skill by scanning its GitHub URL first, for example: Install the commit skill from https://github.com/user/repo/tree/main/skills/commit.
High-intent search queries and answers about installing and using this skill.
To safely install AI coding skills from GitHub, use a security-gated MCP workflow that scans content for prompt injection and supply chain attacks before copying files. This approach enforces URL allowlisting with SSRF prevention to ensure only verified skill content reaches your local directories.
Security-gated skill installation for MCP clients is a workflow that forces a full security scan of GitHub skill content before allowing installation. It uses risk-level gating to permanently block critical threats, ensuring untrusted AI coding assistant skills are verified before reaching your local environment.
You can safely install Claude Code skills by providing the GitHub URL to a security-gated MCP client. The client scans the repository content for threats, applies risk-level gating, and then installs the verified skill into either your global ~/.claude/skills/ or project .claude/skills/ directory.
Yes, you can search the SkillsMP marketplace by keyword or semantic search and use a safe search mode that automatically scans the results. This mode detects prompt injection, reverse shells, and credential theft using 60+ threat patterns before any installation occurs.
Yes, installing MCP skills from GitHub requires SSRF prevention measures like URL allowlisting to block malicious internal network requests. A security-gated installation workflow enforces these protections alongside content hashing and prompt-output sanitization to keep the local registry safe.
To audit installed Claude Code skills, you can use an MCP tool to re-audit skills on demand and hash their content for startup verification. This enables live sync watching to detect unauthorized changes and keep the local skill registry consistent.
marquesfelipValidate outbound HTTP requests to block SSRF and private network access.
linuxhsjManage agent skills via the ClawHub CLI with search, install, update, and publish operations.
cilangzzzSearch SkillsMP marketplace skills using keyword or AI semantic search.
zscoleDetects and sanitizes prompt-injection and command-injection threats in AI agent inputs.
