skill-sentry
mitigative-davidbushnell562/skill-sentrySecurity scanner for Claude MCP skills — scan before you install
Do not install this package
We found dangerous patterns that could harm your computer or steal your data. This package tries to access your SSH keys and credentials. Unless you are 100% sure you trust the author and have reviewed the code yourself, do not install this.
What We Found(12 issues)
Each card explains what was found and what it means in plain English. Click "Technical details" for the full breakdown.
Caution. This package can turn any text into running code. A bad actor could trick it into running harmful commands on your computer. Legitimate tools almost never need this.
Technical details
eval() executes arbitrary strings as code. In an MCP context, this could allow prompt injection to escalate into code execution.
eval(Caution. This package can turn any text into running code. A bad actor could trick it into running harmful commands on your computer. Legitimate tools almost never need this.
Technical details
eval() executes arbitrary strings as code. In an MCP context, this could allow prompt injection to escalate into code execution.
eval(Caution. This package can open a terminal on your computer and run any command it wants — with YOUR permissions. It could delete files, install malware, or steal your data without you seeing anything happen.
Technical details
Importing child_process gives the package ability to spawn shell commands. MCP servers should not need to execute arbitrary system commands.
import { execSync } from "child_process"Caution. This package runs system commands on your computer. This is like giving someone the keys to your terminal. They could run anything — download files, change settings, or access your private data.
Technical details
Direct process execution functions (exec, spawn) can run arbitrary commands. Combined with user input, this enables remote code execution.
execSync(Caution. This package runs system commands on your computer. This is like giving someone the keys to your terminal. They could run anything — download files, change settings, or access your private data.
Technical details
Direct process execution functions (exec, spawn) can run arbitrary commands. Combined with user input, this enables remote code execution.
execSync(Caution. This package runs system commands on your computer. This is like giving someone the keys to your terminal. They could run anything — download files, change settings, or access your private data.
Technical details
Direct process execution functions (exec, spawn) can run arbitrary commands. Combined with user input, this enables remote code execution.
exec(DO NOT INSTALL. This package tries to read your SSH keys — the same keys that unlock your servers, your GitHub account, and your deployments. No Claude skill should ever need to touch these files. This looks like credential theft.
Technical details
Accessing SSH keys or known_hosts is a strong indicator of credential theft. No legitimate MCP server needs access to SSH configuration.
id_rsaDO NOT INSTALL. This package tries to read your SSH keys — the same keys that unlock your servers, your GitHub account, and your deployments. No Claude skill should ever need to touch these files. This looks like credential theft.
Technical details
Accessing SSH keys or known_hosts is a strong indicator of credential theft. No legitimate MCP server needs access to SSH configuration.
id_ed25519DO NOT INSTALL. This package tries to read your SSH keys — the same keys that unlock your servers, your GitHub account, and your deployments. No Claude skill should ever need to touch these files. This looks like credential theft.
Technical details
Accessing SSH keys or known_hosts is a strong indicator of credential theft. No legitimate MCP server needs access to SSH configuration.
known_hostsDO NOT INSTALL. This package tries to read your SSH keys — the same keys that unlock your servers, your GitHub account, and your deployments. No Claude skill should ever need to touch these files. This looks like credential theft.
Technical details
Accessing SSH keys or known_hosts is a strong indicator of credential theft. No legitimate MCP server needs access to SSH configuration.
known_hostsCaution. This package reads your secret passwords and API tokens from your system. If it also has network access, your credentials could be sent to someone else's server. Check WHY it needs your secrets.
Technical details
Reading sensitive environment variables (tokens, secrets, keys, passwords) suggests data exfiltration. MCP servers should declare required env vars, not silently read secrets.
process.env.GH_TOKENCaution. This package reads your secret passwords and API tokens from your system. If it also has network access, your credentials could be sent to someone else's server. Check WHY it needs your secrets.
Technical details
Reading sensitive environment variables (tokens, secrets, keys, passwords) suggests data exfiltration. MCP servers should declare required env vars, not silently read secrets.
process.env.GH_TOKENFinding Summary
0
Critical
12
High
0
Medium
0
Low
0
Info