Skill: mastergear4824/aiclude-vulns-scan (version 3.0.0)

--- name: aiclude-vulns-scan description: Search security vulnerability scan results for MCP Servers and AI Agent Skills from the AICLUDE scan database. tags: [security, vulnerability, scanner, mcp, ai-agent] homepage: https://vs.aiclude.com repository: https://github.com/aiclude/asvs --- # /security-scan - AICLUDE Vulnerability Scanner Search the AICLUDE security scan database for vulnerability reports on MCP Servers and AI Agent Skills. If no report exists, the target is registered and scanned automatically. ## Usage ``` /security-scan --name <package-name> [--type mcp-server|skill] ``` ## Parameters - `--name`: Package name to search (npm package, GitHub repo, etc.) - `--type`: Target type (`mcp-server` | `skill`) - auto-detected if omitted ## Examples ``` /security-scan --name @anthropic/mcp-server-fetch /security-scan --name my-awesome-skill --type skill ``` ## How It Works 1. Sends the package name to the AICLUDE scan API 2. If a scan report exists, returns it immediately 3. If not, registers the target for scanning 4. Waits for the scan to complete and returns the results 5. Results are also viewable at https://vs.aiclude.com Only the package name and type are sent. No source code or credentials are transmitted. ## Output - **Risk Level** (CRITICAL / HIGH / MEDIUM / LOW / INFO) - **Vulnerability List** with locations and descriptions - **Risk Assessment** and remediation recommendations ## Links - **Web Dashboard**: https://vs.aiclude.com - **npm**: [`@aiclude/security-skill`](https://www.npmjs.com/package/@aiclude/security-skill) - **MCP Server**: [`@aiclude/security-mcp`](https://www.npmjs.com/package/@aiclude/security-mcp) ## License Apache 2.0 - AICLUDE Inc.

path: README.md
content: # @aiclude/security-skill

Security vulnerability scanner for MCP Servers and AI Agent Skills. Provides the `/security-scan` slash command for Claude Code.

Queries the [AICLUDE scan database](https://vs.aiclude.com) for existing vulnerability reports. If no report exists, the target is automatically registered and scanned server-side.

## Installation

```bash
npm install @aiclude/security-skill
```

## Usage

### As a Claude Code Skill

```
/security-scan --name @anthropic/mcp-server-fetch
/security-scan --name my-awesome-skill --type skill
```

### Programmatic API

```typescript
import { SkillHandler } from "@aiclude/security-skill";

const handler = new SkillHandler();

const report = await handler.lookup({
  name: "@some/mcp-server",
  type: "mcp-server",
});
```

## Parameters

| Parameter | Description |
|-----------|-------------|
| `--name` | Package name to search (npm, GitHub, etc.) |
| `--type` | `mcp-server` or `skill` (auto-detected) |

## How It Works

1. Sends the package name to the AICLUDE scan API
2. If a scan report exists, returns it immediately
3. If not, registers the target for server-side scanning
4. Waits for the scan to complete and returns the results

Only the package name and type are sent. No source code, files, or credentials are transmitted.

## Server-Side Scan Engines

The AICLUDE server runs 7 engines on registered targets:

| Engine | What It Detects |
|--------|----------------|
| SAST | Code vulnerabilities via pattern matching |
| SCA | Known CVEs in dependencies (OSV.dev) |
| Tool Analyzer | MCP tool poisoning, shadowing, rug-pull |
| DAST | SQL/Command/XSS injection via fuzzing |
| Permission Checker | Excessive filesystem/network/process access |
| Behavior Monitor | Suspicious runtime behavior patterns |
| Malware Detector | Backdoors, cryptominers, ransomware, data stealers |

## Output

Reports include:

1. **Risk Level** — CRITICAL / HIGH / MEDIUM / LOW / INFO
2. **Vulnerability List** — code location, description, severity
3. **Risk Assessment** — impact and likelihood analysis
4. **Remediation** — how to fix each finding

## Related Packages

- [`@aiclude/security-mcp`](https://www.npmjs.com/package/@aiclude/security-mcp) — MCP Server interface
- [vs.aiclude.com](https://vs.aiclude.com) — Web dashboard with full scan results

## License

Apache 2.0 — [AICLUDE Inc.](https://aiclude.com)


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)