Back to Dashboard
50

Every AI skill, independently scanned. Public, open-source trust scoring for skills, MCP servers, hooks, and plugins across every agent platform.

saferskills0465 files scannedMay 29, 2026

Do not install this package

We found dangerous patterns that could harm your computer or steal your data. This package tries to access your SSH keys and credentials. Unless you are 100% sure you trust the author and have reviewed the code yourself, do not install this.

What We Found(1 issue)

Each card explains what was found and what it means in plain English. Click "Technical details" for the full breakdown.

HIGHHIGH-004

DO NOT INSTALL. This package tries to read your SSH keys — the same keys that unlock your servers, your GitHub account, and your deployments. No Claude skill should ever need to touch these files. This looks like credential theft.

Technical details

Accessing SSH keys or known_hosts is a strong indicator of credential theft. No legitimate MCP server needs access to SSH configuration.

~/.ssh
webapp/src/data/homepage-constants.ts:617

Finding Summary

0

Critical

1

High

0

Medium

0

Low

0

Info