How do I install the Skillfrisk skill?

Run npx skillmds@latest add topicspot/skillfrisk in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Skillfrisk safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Skillfrisk?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Skillfrisk free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Skillfrisk?

Topicspot (@topicspot) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Skillfrisk by topicspot — Agent Skill

Name: Skillfrisk
Author: Topicspot

Skillfrisk

Security-scan any AI-agent skill or MCP server before installing or publishing it. Use when the user asks to check, audit, or vet a skill/MCP server, or before adding third-party skills from GitHub. Detects prompt injection, secret exfiltration, remote code execution, destructive commands, and dangerous MCP permissions.

Topicspot 2ab8ae3 14 files · 191.3 KB Updated Sep 17, 2026

File contents

skillfrisk — vet skills and MCP servers before trusting them

Third-party skills and MCP servers are executable instructions for your agent. Scan them before installing. skillfrisk statically checks SKILL.md files, bundled scripts, and MCP manifests for high-risk patterns.

Run a scan

No installation needed (requires uv):

uvx --from "git+https://github.com/Topicspot/skillfrisk" skillfrisk scan path/to/skill-or-mcp

Machine-readable output for your own decision-making:

uvx --from "git+https://github.com/Topicspot/skillfrisk" skillfrisk scan path/to/skill --json

Exit code 2 means high/critical findings — do NOT install the scanned skill without showing the findings to the user first.

Typical workflow

User asks to install a third-party skill or MCP server (e.g. from GitHub).
Clone or download it to a temp directory first — do not install yet.
Run skillfrisk on that directory.
Exit 0 → proceed. Exit 2 → stop, show the findings table to the user, and let them decide.

What it detects

Prompt-injection instructions hidden in skill docs and HTML comments
Access to credentials, key files, and environment secrets, plus exfiltration to remote hosts
Remote code execution: piping downloads into a shell, dynamic code evaluation, unsafe subprocess use
Destructive filesystem commands and fork bombs
Over-broad MCP manifests (wildcard permissions, dangerous tool combinations)

False positives are controlled by a regression corpus of popular real-world skills (see tests/corpus/).

CI usage

- uses: Topicspot/skillfrisk@main
  with:
    path: "."

---name: skillfriskdescription: Security-scan any AI-agent skill or MCP server before installing or publishing it. Use when the user asks to check, audit, or vet a skill/MCP server, or before adding third-party skills from GitHub. Detects prompt injection, secret exfiltration, remote code execution, destructive commands, and dangerous MCP permissions.---# skillfrisk — vet skills and MCP servers before trusting themThird-party skills and MCP servers are executable instructions for your agent.Scan them before installing. skillfrisk statically checks SKILL.md files, bundledscripts, and MCP manifests for high-risk patterns.## Run a scanNo installation needed (requires `uv`):```bashuvx --from "git+https://github.com/Topicspot/skillfrisk" skillfrisk scan path/to/skill-or-mcp```Machine-readable output for your own decision-making:```bashuvx --from "git+https://github.com/Topicspot/skillfrisk" skillfrisk scan path/to/skill --json```Exit code `2` means high/critical findings — do NOT install the scanned skillwithout showing the findings to the user first.## Typical workflow1. User asks to install a third-party skill or MCP server (e.g. from GitHub).2. Clone or download it to a temp directory first — do not install yet.3. Run skillfrisk on that directory.4. Exit 0 → proceed. Exit 2 → stop, show the findings table to the user, and let them decide.## What it detects- Prompt-injection instructions hidden in skill docs and HTML comments- Access to credentials, key files, and environment secrets, plus exfiltration to remote hosts- Remote code execution: piping downloads into a shell, dynamic code evaluation, unsafe subprocess use- Destructive filesystem commands and fork bombs- Over-broad MCP manifests (wildcard permissions, dangerous tool combinations)False positives are controlled by a regression corpus of popular real-worldskills (see `tests/corpus/`).## CI usage```yaml- uses: Topicspot/skillfrisk@main with: path: "."```

Frequently asked questions