skill-security-check
aliks v2.5.0
Security audit plugin that scans Claude Code skills, hooks, and MCP configurations for threats. Detects 37 attack patterns including prompt injection, data exfiltration, supply chain attacks (Toxic...
From the developer
License
MIT
Works with
Claude Code
Description
From the marketplace listing
Security audit plugin that scans Claude Code skills, hooks, and MCP configurations for threats. Detects 37 attack patterns including prompt injection, data exfiltration, supply chain attacks (ToxicSkills/ClawHavoc), credential theft, reverse shells, backdoor persistence, API endpoint hijacking, Unicode homoglyph attacks, and context window poisoning. Includes runtime hooks for Bash command validation and MCP response inspection.
What changed
No changes recorded yet. Follow this plugin to keep track of future changes.
Similar plugins
Find competitors to follow as you develop your plugin.
-
Frictionless security, compliance, and threat detection for Claude Code and Co-Work. Advanced Behavioral detection patterns catch credent...
Shared terms: exfiltration, injection, threat, prompt
-
> Automatic security scanner for Claude Code plugins — detects new or updated extensions at session start and scans them for prompt injec...
Shared terms: detect, exfiltration, injection, scan
-
Security guard hook for Claude Code. Evaluates every tool call (Bash, Edit, Write, Read, MCP) against 864 pattern-matching rules to block...
Shared terms: hook, pattern, security, mcp
-
Real-time security filter for MCP tool communications. Works as a Claude Code hook to inspect all data sent to and received from MCP serv...
Shared terms: detect, injection, prompt, hook
-
LLM security for AI coding agents. Protect applications from prompt injection, PII leakage, and data exfiltration. Provides MCP tools for...
Shared terms: exfiltration, injection, prompt, security
Keywords
Files & skills
skill-security-check · catalog manifest
Saved declaration
{}
skill-security-check · catalog manifest
Saved declaration
{
"name": "skill-security-check",
"source": {
"sha": "6a8fcc393be87b3becea9262ea2696a165e02898",
"url": "https://github.com/aliksir/claude-code-skill-security-check.git",
"source": "url"
},
"homepage": "https://github.com/aliksir/claude-code-skill-security-check#readme",
"description": "Security audit plugin that scans Claude Code skills, hooks, and MCP configurations for threats. Detects 37 attack patterns including prompt injection, data exfiltration, supply chain attacks (ToxicSkills/ClawHavoc), credential theft, reverse shells, backdoor persistence, API endpoint hijacking, Unicode homoglyph attacks, and context window poisoning. Includes runtime hooks for Bash command validation and MCP response inspection."
}
skill-security-check · catalog manifest
Saved declaration
{
"name": "skill-security-check",
"author": {
"url": "https://github.com/aliksir",
"name": "aliks"
},
"license": "MIT",
"version": "2.5.0",
"homepage": "https://github.com/aliksir/claude-code-skill-security-check",
"keywords": [
"security",
"audit",
"skills",
"mcp",
"semgrep",
"hooks"
],
"repository": "https://github.com/aliksir/claude-code-skill-security-check",
"description": "Security audit for Claude Code community skills — scans for prompt injection, data exfiltration, permission bypass, and 10+ attack patterns"
}
plugin.json observed Nov 6, 2026 · 10:49 UTC. Manifest source ↗
Catalog declarations and available plugin.json metadata are saved. Referenced skills and executable source files are not downloaded or tested. Missing components in a manifest do not prove that the plugin has none.
Installation instructions
Community
/plugin marketplace add anthropics/claude-plugins-community
/plugin install skill-security-check@claude-communityTechnical details
- Sources
- Community
- First seen
- Oct 3, 2026 · 22:13 UTC
- Last seen
- Nov 7, 2026 · 12:00 UTC
- Latest observed change
- Oct 3, 2026 · 22:13 UTC
- Collection status
- Listed
- Reported installs
- Not provided
Installation counts are source-reported, not independently verified active users. Observation dates are not release dates.
Download plugin data (JSON)Plugin history: freshly prepared. Prepared . Refreshed when catalog data changes or after 6 hours. Your account and Follow status are live.