Catalog / Categories

Security & trust

Vetting skills, secrets hygiene, code and supply-chain review.

Entries

• SkillSpector

  NVIDIA's scanner that checks an agent skill or MCP server for prompt injection, data exfiltration and other risks before you install it.

  Tool by NVIDIA Any agent, Claude Code, Codex, Gemini

  Official Reviewed — safe to install Runs on your machine

• Cisco Skill Scanner

  Cisco AI Defense's scanner for agent skills, combining YARA and pattern rules, code dataflow analysis and an optional LLM judge to flag prompt injection, exfiltration and malicious code.

  Tool by Cisco AI Defense Any agent, Claude Code, Codex, Cursor

  Official Reviewed — safe to install Runs on your machine

• Claude Code official plugin directory

  Anthropic's plugin marketplace for Claude Code, with Anthropic-built plugins for code review, security review, plugin and MCP development, plus vetted partner plugins.

  Plugin by Anthropic Claude Code

  Official Reviewed — install with care Changes things freely

• Gitleaks

  Finds API keys, tokens and other secrets in a git history, a folder or piped input, locally and with no account.

  Tool by Gitleaks Any agent

  Official Reviewed — safe to install Runs on your machine

• OpenSSF Scorecard

  Scores a GitHub or GitLab repository on security practices — branch protection, pinned dependencies, signed releases, dangerous workflows, maintenance — so you can judge where a skill comes from.

  Tool by OpenSSF Any agent

  Official Reviewed — safe to install Reads your accounts

• OSV-Scanner

  Google's scanner that matches a project's lockfiles, vendored code or container image against the open OSV.dev vulnerability database.

  Tool by Google Any agent

  Official Reviewed — safe to install Runs on your machine

• Snyk Agent Scan

  Finds the MCP servers and skills installed across your coding agents and checks them for prompt injection, tool poisoning, toxic flows and malicious code.

  Tool by Snyk Any agent, Claude Code, Claude apps, Cursor, Codex, Gemini

  Official Reviewed — install with care Runs on your machine

Curated by Andrew Borden-Chisholm. Notes on building with these tools are on the blog.