Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ulises-jeremias/agent-toolkit --skill mcp-auditgit clone --depth 1 https://github.com/ulises-jeremias/agent-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ulises-jeremias/agent-toolkit/mcp-audit)<a href="https://agentmods.dev/skills/ulises-jeremias/agent-toolkit/mcp-audit"><img src="https://agentmods.dev/badge/skills/ulises-jeremias/agent-toolkit/mcp-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ulises-jeremias/agent-toolkit/mcp-audit"><img src="https://agentmods.dev/badge/skills/ulises-jeremias/agent-toolkit/mcp-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00050 | $0.01993 |
| Opus 5.5 | $0.00020 | $0.00797 |
| Sonnet 5.5 | $0.00010 | $0.00399 |
| Haiku 4.5 | $0.00005 | $0.00199 |
Grade C, and why
mcp-audit scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Instruction-override phrasingmediumPrompt injection
Text telling the model to disregard its earlier instructions or safety rules is the shape of a prompt injection, whoever wrote it.
- [ ] Tool descriptions in registry `tools.read/write` do not contain prompt injections (e.g., `ignore previous instructions`, `send secrets to`). Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Cloud metadata endpointmediumServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
- [ ] `network_hosts` does not include internal metadata endpoints (`169.254.169.254`, `metadata.google.internal`). Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 117 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MCP Audit — Config + Implementation Security
Audit MCP servers before adopting — static inspection only, never execute remote servers. Use when reviewing mcp/registry/*.yaml, mcp/templates/*/config.template.json, skill/plugin MCP declarations, or when a static surface scan flags MCP references.
Single skill, two modes — decision per #379 review: config and implementation scopes meaningfully overlap (both inspect mcp/registry/*.yaml + templates), but checklists differ enough to keep separate gates. One skill with two modes avoids duplicating registry parsing while keeping config (secret hygiene, version pinning) distinct from implementation (command injection, SSRF, tool poisoning).
Static only: Do not start or call remote MCP servers during audit. Inspect YAML/JSON, package provenance, tool descriptions, and env handling.
Modes
| Mode | What it checks | Evidence |
|---|---|---|
| Config audit | mcp/registry/*.yaml auth, package provenance, version pinning, remote vs local, OAuth, env/secret exposure, permissions |
Registry YAML, template JSON, env var names, docs/MCP.md |
| Implementation audit | Command injection, shell execution, SSRF, unsafe args, tool description poisoning, secret env leakage, dangerous permissions, transport security | Skill SKILL.md + static surface patterns (shell/network/mcp/hooks), tool definitions, args validation, network_hosts |
Run the relevant mode per request; for full adoption review, run both and emit a single mcp-audit-report.md.
Config audit — checklist
Auth & secrets
-
auth.envlists only env var names, never values (scan registry YAML forghp_,xoxb, hardcoded tokens) - Template
config.template.jsonuses${ENV_VAR}placeholders (no real credentials) - Remote MCP (
streamable_httpURL likehttps://mcp.figma.com/mcp) documents auth asbearer-envwith region var, not query param - Local MCP (
stdiovianpx/docker/uvx) does not embed secrets inargs— secrets only inenv - No
default-branch pushorfilesystemWritesbeyond declaredsecurity.network_hosts
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 117 lines · 50 tokens per session scan C b4ee4c43c3df
mcp-audit is a skill published in the GitHub repository ulises-jeremias/agent-toolkit (19 stars, last pushed yesterday), licensed MIT. It adds 50 tokens to every session and 1,993 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it C with 2 findings (instruction-override phrasing, cloud metadata endpoint). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other skills, from other repositories
verify
Fact-check claims encountered during reading — dates, names, events, citations. Use when encountering historical facts or disputed claims.
skillnote
Self-hosted skill registry for OpenClaw. Stores procedures your team writes (name, description, body), syncs them to disk before each task, and collects which-helped/which-failed signals from the agent so the registry improves over time.
pr-alignment-loop
Iterate a PR to its final form by running two opposing reviewer droids (reviewer-robustness and reviewer-minimalist) in a bounded back-and-forth loop. The main orchestrator synthesizes their feedback, makes edits, runs tests, and stops when both approve, on stagnation, or after 3 rounds. Use when the user asks to…
publish-website
Publish a website to Porkbun Secure Static Hosting. Use when the user asks you to build, create, update or put live a website, landing page or placeholder page for a domain they have at Porkbun, mentions Porkbun hosting or static hosting, or asks how to upload site files to Porkbun.
create-rule
Use when creating, writing, or updating a Claude Code rule file (.claude/rules/.md or /.claude/rules/.md), or when asking about rule format, path scoping, or rule best practices.
platform-setup
Set up, verify, and troubleshoot Katalon True Platform/TestOps MCP connectivity for any AI coding agent. Use when you need to install or configure the Katalon MCP server, connect to a Katalon platform account, verify available Katalon MCP tools, diagnose missing authentication or repository access, confirm…