Snyk Agent Scan repo
Snyk's open scanner for AI agents, MCP servers and agent skills. Version 0.6 and later detects 14 distinct security risks: prompt injection, untrusted content handling, private data exposure, destructive capabilities, suspicious downloads, malicious code, insecure credential handling and secret detection among them.
What it does for you: YY's Skills folder has over 700 skills synced from many sources. This is a direct way to run one scan over AXION's Skills folder before syncing anything new into .claude skills, instead of trusting a README by eye.
In practice: A boring, well scoped security tool from an established vendor, exactly the kind of thing that is easy to skip and expensive to have skipped.
For: Both runtimes. A CLI scanner that reads skill and MCP config files directly, no dependency on which agent runtime consumes those skills afterward.
Verdict: build now. Low setup cost, backed by a known security vendor, and directly answers a real gap: nothing currently scans AXION's skill inventory before sync.
Build #1 Snyk Agent Scan: use the ai-implementation-build-intake skill to build this safely. Source: https://github.com/snyk/agent-scan. Save canonical skill/agent under AXION\Skills and AXION\Agents.
Source · Agent Scan v0.6 documents 14 named risk categories across MCP servers and agent skills, per the project's own risks.md referenced from its README on GitHub.