Claude Skill Antivirus

A security scanner and safe installer for Claude Code Skills. Detects malicious patterns, data exfiltration attempts, and dangerous operations before installing third-party skills.

Compatible with Claude Code using Opus 4.6, Sonnet 4.6, and Haiku 4.5 models.

繁體中文說明 | SkillsMP Scan Report

SkillsMP Platform Scan Results

We scanned all 71,577 skills on SkillsMP:

Risk Level	Count	Percentage
CRITICAL	91	0.13%
HIGH	626	0.87%
MEDIUM	1,310	1.83%
SAFE	69,505	97.11%

~3% of skills may have potential risks. See full report for details.

Note: Some findings may be false positives (e.g., legitimate 1Password/Bitwarden integrations). Manual review is recommended for flagged skills.

Features

• 9 Security Scanning Engines:

  • Dangerous Commands Scanner - Detects destructive shell commands
  • Data Exfiltration Scanner - Identifies data theft patterns
  • External Connections Scanner - Analyzes URLs and network calls
  • Permission Scanner - Reviews tool permissions and access scope
  • Pattern Scanner - Detects prompt injection and sensitive data
  • MCP Security Scanner - Validates MCP server configurations
  • SSRF Scanner - Identifies server-side request forgery patterns
  • Dependency Scanner - Detects malicious packages and typosquatting
  • Sub-agent Scanner - Detects Task tool abuse and agent chain attacks

• Risk Assessment: Critical, High, Medium, Low, and Info levels

• Multilingual Support: English and Traditional Chinese (繁體中文)

• Install or Scan-Only Mode: Review skills before installation

• Interactive Prompts: Guided decision-making for risky installations

Installation

npm install -g claude-skill-antivirus

Or run directly with npx:

npx claude-skill-antivirus <skill-source>

Usage

Install a skill with security scanning

# Install to project level (./.claude/skills/) - default
skill-install ./path/to/skill
skill-install https://github.com/user/skill-repo

# Install to user level (~/.claude/skills/)
skill-install ./path/to/skill --global
skill-install @skillsmp/example-skill -g

Installation paths:

• Project level (default): ./.claude/skills/
• User level (--global): ~/.claude/skills/

Scan only (without installing)

skill-install ./path/to/skill --scan-only

Change language

# English (default)
skill-install ./path/to/skill --lang en

# Traditional Chinese
skill-install ./path/to/skill --lang zh-TW

Alternative command

claude-skill-av ./path/to/skill --scan-only

Batch scan all SkillsMP skills

# Scan all skills from SkillsMP (requires API key)
skill-batch-scan --api-key <your-api-key>

# Scan with options
skill-batch-scan --api-key <key> --max-pages 10 --verbose
skill-batch-scan --api-key <key> --output ./my-reports --lang zh-TW

Options:

• -k, --api-key <key> - SkillsMP API key (required)
• -l, --limit <number> - Skills per page (default: 100)
• -p, --max-pages <number> - Maximum pages to scan (default: all)
• -o, --output <dir> - Output directory for reports (default: ./scan-reports)
• -v, --verbose - Show verbose output
• --lang <lang> - Language (en, zh-TW)

Scanning Engines

1. Dangerous Commands Scanner

Detects commands that can cause system damage: