Is this Claude skill or MCP server safe? 43 red flags to check first
Agent skills (SKILL.md), MCP server configs and agent settings files run with your permissions: your shell, your files, your API keys. Before you install one, read it for these patterns. Our free scanner checks all 43 in your browser.
Stop and read carefully (21 red flags)
- Downloads code and runs it immediately: whatever the server sends gets executed.
- Runs the output of a download as a shell command.
- Downloads a script to disk and runs it right away.
- PowerShell Invoke-Expression runs arbitrary strings as code.
- Decodes hidden base64 content and runs it.
- Reverse shell: gives a remote machine control of this computer.
- Invisible or text-direction Unicode characters: what you read is not what the agent reads.
- Classic prompt-injection phrase trying to override the agent's instructions.
- Tells the agent to act without the user knowing.
- Known data-collection / tunnelling endpoint: a common destination for stolen data.
- Reads or sends credential files (SSH keys, agent/cloud/GitHub/npm tokens, browser cookies).
- Recursively deletes the root or home directory.
- Disk format or fork bomb.
- Turns off the agent's permission prompts or auto-enables every MCP server.
- Grants unrestricted shell or every tool without asking.
- Hardcoded Anthropic API key.
- Hardcoded OpenAI-style API key.
- Hardcoded GitHub token.
- Hardcoded AWS access key.
- Hardcoded Slack token.
- Embedded private key.
Fine sometimes, but find out why (22 yellow flags)
- One-liner code that talks to the network; check what it sends.
- Dynamic code evaluation; check what string is being run.
- Long base64-looking blob; could hide a payload. Decode it and read it.
- Long run of hex escapes; often used to hide strings.
- Latin word mixed with Cyrillic/Greek look-alike letters (homoglyphs) - a way to dodge keyword filters.
- Instructions hidden in an HTML comment (invisible when rendered).
- Tries to change the agent's role or rules.
- Mentions a credential file path; make sure it is only used, not read or sent.
- Reads or dumps environment secrets (.env / all env vars).
- Sends data to a remote server; check what and where.
- URL with a raw IP address instead of a domain.
- DNS lookup built from command output: a known exfiltration trick.
- Redirects API traffic (base URL / proxy override): could route your keys and prompts through someone else's server.
- Writes raw data to a disk device; fine for flashing an image, destructive otherwise.
- Asks for root privileges.
- Makes files world-writable or setuid.
- Installs something that runs again later (cron, startup files, services).
- Writes git hooks: code that runs on every commit/checkout.
- Agent settings that run shell commands automatically (hooks, key helper, status line). Read every command.
- Skill pre-approves powerful tools (shell, web, file writes). Make sure it needs them.
- Runs a package without a pinned version: a future malicious release would run automatically.
- Downloads over plain HTTP (can be tampered with in transit).
Three habits that catch most problems
- Read the whole file, including HTML comments and anything after the visible instructions; paste it into a plain-text editor to see hidden characters.
- Never let a skill turn off permission prompts or pre-approve shell access it doesn't clearly need.
- Pin versions (
[email protected], not@latest) so an update can't change what runs.
Pattern checks, not a guarantee: a clean scan means none of these patterns were found, not that the file is safe. Nothing you paste is uploaded.