1. Conduid
  2. Social
  3. Skillxray
MCP server · Social

Skillxray

by · github.com/munzzyy/skillxray

Scan an AI agent skill for prompt injection, hidden Unicode, dangerous commands, and leaked secrets before you install it.

Unclaimed agent-skillsai-securityclaudeclaude-codeclillm-securitymcpprompt-injectionpythonsastsecrets-detectionsecurity-scannerskillsstatic-analysissupply-chain
InstallView source
34Low

Scored 27 days ago · breakdown

About Skillxray

Skillxray is an MCP server published by munzzyy in the Social category: scan an AI agent skill for prompt injection, hidden Unicode, dangerous commands, and leaked secrets before you install it.

The repository has 1 stars and 0 forks, with the last commit 15 days ago. Recent commit activity is the strongest signal that reported issues will get attention.

Install

From source
git clone https://github.com/munzzyy/skillxray

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Ask AI

✦

Ask AI about Skillxray

Powered by Claude · Grounded in docs

I know everything about Skillxray. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

6 checks have not been run yet.

Releases

v0.3.0v0.3.0 · 2 Oct 2026Several of these widen what a scan reads. A skill or repo that graded A on v0.2.1 can grade lower now, so check your `--fail-on` gate after you upgrade. Did a grade move in a way that looks wrong? Please open an…
v0.2.0v0.2.0 · 15 Jul 2026First PyPI release that makes `pipx install skillxray` real. Added a terminal demo, a runnable (fake, inert) malicious example skill in `examples/`, MCP-bundle positioning, and a "where it fits" section against Semgrep, TruffleHog, and…
v0.1.1v0.1.1 — scanner hardening · 12 Jul 2026Fixes five fail-open gaps found in a cross-model security review, so a hostile skill can't slip past the scanner: git clone arg injection**: a repo URL starting with `-` (e.g. `--upload-pack=…`) could be read as a git option and run a…
Questions

About Skillxray

How do I install Skillxray?

No package has been published for this server, so install it from source: clone the repository and follow its README.

Is Skillxray safe to use with an AI agent?

Its trust score is 34 out of 100 (low). Conduid hasn't run static security checks on this repository yet, so review the source yourself before granting it credentials. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Skillxray still maintained?

Yes — the latest release is v0.3.0 (2 Oct 2026), and the last commit was 15 days ago. The repository has 1 stars.