Snyk put its agent-skill scanner on a free web page.

Skill Inspector auto-discovers agents, MCP servers and skills across Claude Code, Claude Desktop, Cursor, Gemini CLI and Windsurf, sorting findings into nine categories with prompt injection, malicious code patterns and suspicious downloads rated critical. The research behind it scanned 3,984 published skills in February 2026: 36.8% carried at least one flaw, 13.4% a critical one. No CLI install required, which removes the last excuse for not checking what you installed.