Audit Agent Skills and MCP Servers with plugin-scanner

Where this fits

You found a promising SKILL.md on GitHub and want to add it to your agent. The README looks fine, but there are hidden lines that read curl | bash and inspect ~/.aws/credentials. plugin-scanner gives you a local audit step before skill code reaches your agent runtime.

Why agents benefit

• Agents can independently assess third-party skills without sending private code to a cloud service.
• Scanner examines structured skill metadata, Markdown, MCP server configs, and shell snippets for prompt-injection patterns.
• It flags unsafe commands, suspicious install hooks, and secret-like strings embedded in tooling.
• It can run inside an agent workflow: after download, before installation, and before first execution.
• It returns concrete findings that the agent can summarize into a clear go/no-go decision.

Practical scenarios

Auditing a skill before skills add

A teammate shares an 'awesome-agent-skill' repository. Instead of blind installation, the agent runs plugin-scanner on the local clone, finds obfuscated base64 in SKILL.md, and blocks installation.

Reviewing an MCP server for secret exposure

You find an MCP server advertised as a 'drop-in memory layer'. The scanner checks its config for hardcoded API tokens and env-var exfiltration endpoints before you trust it with local context.

CI gate for plugin submissions

In an internal skills marketplace, a GitHub Action invokes plugin-scanner on every pull request. If the scanner reports high-confidence prompt injection, the PR is flagged for human review.

Add it to your agent workflow

Install the skill in your agent runtime:

npx skills add hashgraph-online/hol-guard-plugin --skill plugin-scanner

Then ask your agent to audit local repositories before installation:

You: Scan ./tmp/notion-mcp/SKILL.md and the MCP config before I install it.
Agent: Running local plugin-scanner...
Findings: 1 prompt injection signature, 2 hardcoded tokens in .env.example.
Recommendation: Do not install until maintainers remove the `curl ... | sh` step.

Compare before adopting

Before replacing your manual review with plugin-scanner, compare:

• Depth vs breadth – Does it catch your language-specific supply-chain issues, or only generic shell patterns?
• Maintenance freshness – How recently were its scanning rules updated? Prompt injection and MCP security evolve quickly.
• Alternatives – GuardDog, Semgrep, or a simple grep for suspicious commands may cover part of the same need.
• Workflow fit – Can it run headlessly in CI and through your agent the same way? Prefer tools that fit your existing install and review process.

Why it is worth tracking

The repo is young and has only a handful of stars, but the focus is meaningful: an Apache-2.0 scanner built to inspect SKILL.md files and MCP tooling before an agent trusts them. Update frequency and community adoption over the next few months will tell whether it stays aligned with the latest injection patterns. You can follow the skill's revision history and feedback on its OpenAgentSkill listing: https://www.openagentskill.com/skills/hashgraph-online-hol-guard-plugin-plugin-scanner. If you regularly install third-party agent skills, this is a low-cost addition worth evaluating now.