Snyk put its agent-skill scanner behind a free web page called Skill Inspector
Snyk Labs published Agent Scan Skill Inspector as a free self-service site that inspects a skill for malicious code, insecure configuration, and leaked secrets without installing the CLI. It auto-discovers agents, MCP servers, and skills across Claude Code, Claude Desktop, Cursor, Gemini CLI, and Windsurf, and sorts findings into nine categories: prompt injection, malicious code patterns, and suspicious downloads at critical; improper credential handling and hardcoded secrets at high; third-party content exposure, unverifiable dependencies, direct financial access, and system service modification at medium. The backing research scanned 3,984 published skills in February 2026 and found 36.8% carrying at least one flaw and 13.4% a critical one.
Source
↳ Follow the thread