Quando usar: Someone sent you a cool-looking skill link. Before clone, you want to know if it's safe.
Fluxo
-
Point at the target repo URL
Use repo-forensics. Scan https://github.com/<author>/<skill> with the skill_threats, secrets, dataflow, and lifecycle scanners. Report findings.✓ Copiado
→ Per-scanner report with severity flags
-
Read correlated findings
Any correlations across scanners — e.g. a secret-leak path plus a lifecycle hook?✓ Copiado
→ Correlation summary
Resultado: A go / no-go decision grounded in scanner output, not vibes.
Armadilhas
- Trusting a green scan as full proof of safety — Scanners are strong floor, not a ceiling — still read SKILL.md
Quando usar: Before adding a new MCP server to an agent with real permissions.
Fluxo
-
Run MCP-focused scanners
Scan this MCP server repo with mcp_security, skill_threats, integrity, and dast.✓ Copiado
→ Findings focused on tool descriptions and install scripts
-
Check git history for identity spoofing
Run git_forensics on the same repo — any spoofed commits?✓ Copiado
→ Author / signing analysis
Resultado: An MCP security dossier before you wire it into your agent.
Quando usar: Install finished with unexpected behavior; you want to know if something landed.
Fluxo
-
Run post_incident + entropy scans
Run post_incident scanner on ~/.npm and the current project. Also entropy scan the installed packages.✓ Copiado
→ Flags for suspicious cached artifacts or encoded payloads
Resultado: Evidence of whether to rotate secrets and rebuild.
Armadilhas
- Running scans from the potentially-compromised shell — Run from a fresh shell or another machine when in doubt