Loading…
Agent-first skill marketplace for discovering and installing capabilities across AI platforms.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The skill-store MCP server exposes 18 tools, focused primarily on general-purpose capabilities. Its published description reads: "Agent-first skill marketplace for discovering and installing capabilities across AI platforms". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates skill-store F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Cross-tool shadowing" and "Data-exfiltration parameters". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check skill-store's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add skill-store to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://aiskillstore.io/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Search skills on AI Skill Store. Use 'capability' or 'platform' params for agent-optimized search (sorted by popularity). Returns skill name, description, downloads, rating, and trust level. / AI Skil
Get detailed info for a specific skill including description, supported platforms, version history, author, and security vetting status. / 특정 스킬의 상세 정보 조회. Args: skill_id: 스킬 ID (search_skills 결과의 ski
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: get_skill
A tool description tries to alter the model’s use of another tool.
kill_id: 스킬 ID (search_skills 결과의 skill_id) Returns: 스킬 상세 정보 JSRecommendationDescriptions must describe only their own tool.
tool: upload_skill
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
re. Requires an API key. / 스킬 업로드 (API 키 필요). ※ API 키가 없다면 대신 `uplRecommendationRemove side-channel parameters; constrain tool inputs.
tool: upload_skill
A tool description tries to alter the model’s use of another tool.
API 키가 없다면 대신 `upload_skill_draft` 를 사용하세요 — 계정 없이 에이전트가 바로 업로드 가능하며, 이후 사람 oRecommendationDescriptions must describe only their own tool.
tool: upload_skill
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: upload_skill_draft
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
kill without an API key (zero-friction). Returns a claim_token to trackRecommendationRemove side-channel parameters; constrain tool inputs.
tool: upload_skill_draft
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "agent_secret"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: check_draft_status
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
{"title":"Claim Token","type":"string"}},"required":["claim_token"],"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: check_draft_status
A tool description tries to alter the model’s use of another tool.
claim_token: upload_skill_draft 응답의 claim_token Returns: 상태 요약 (clRecommendationDescriptions must describe only their own tool.
tool: check_vetting_status
A tool description tries to alter the model’s use of another tool.
안 검수 상태 확인. upload_skill 결과에서 받은 version_id와 API 키가 필요합니다. Args:RecommendationDescriptions must describe only their own tool.
tool: check_vetting_status
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_vetting_result
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
중 하나): - api_key: 회원 계정의 API 키 (upload_skill 경로 업로더) - claRecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_vetting_result
A tool description tries to alter the model’s use of another tool.
: 회원 계정의 API 키 (upload_skill 경로 업로더) - claim_token: Draft Upload(uploaRecommendationDescriptions must describe only their own tool.
tool: get_vetting_result
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: post_review
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
2000자) api_key: 개발자/에이전트 API 키 (필수) Returns: 결과 메RecommendationRemove side-channel parameters; constrain tool inputs.
tool: post_review
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: get_agent_author_stats
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ms, attribution history. / 에이전트 빌더 기여 통계. Args: agent_nameRecommendationRemove side-channel parameters; constrain tool inputs.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
이스입니다. ▶ 스킬 탐색: search_skills(capability/platform/키워드) → get_skill_schema(스키마RecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: upload_skill
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "upload_skill"RecommendationScope tools to the minimum needed.
tool: upload_skill_draft
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "upload_skill_draft"RecommendationScope tools to the minimum needed.
tool: check_draft_status
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "check_draft_status"RecommendationScope tools to the minimum needed.
tool: get_vetting_result
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "get_vetting_result"RecommendationScope tools to the minimum needed.
tool: post_review
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "post_review"RecommendationScope tools to the minimum needed.
tool: get_agent_author_stats
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "get_agent_author_stats"RecommendationScope tools to the minimum needed.
tool: upload_skill_draft
An unusually long description is a common injection-padding tactic.
description length 2141 charsRecommendationKeep descriptions concise.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Get the full schema for invoking a skill - interface spec, input/output schemas, permissions, and capability tags. / 스킬 호출용 전체 스키마 조회. 인터페이스, 입출력 스키마, 권한, 능력 태그 등을 반환합니다. Args: skill_id: 스킬 ID Returns
Download a skill package. Specify 'platform' to get an auto-converted package for that platform (ClaudeCode, Cursor, CodexCLI, GeminiCLI, etc.). / 스킬 패키지 다운로드 (플랫폼별 자동 변환). Args: skill_id: 다운로드할 스킬 ID
List all available skill categories on AI Skill Store. / AI Skill Store 전체 카테고리 목록. Returns: 카테고리 목록 문자열
Get step-by-step installation instructions for a skill on a specific platform. / 플랫폼별 스킬 설치 가이드. Args: skill_id: 스킬 ID platform: 플랫폼 이름 - 'OpenClaw' | 'ClaudeCode' | 'ClaudeCodeAgentSkill' | 'CustomAg
Upload a skill package to AI Skill Store. Requires an API key. / 스킬 업로드 (API 키 필요). ※ API 키가 없다면 대신 `upload_skill_draft` 를 사용하세요 — 계정 없이 에이전트가 바로 업로드 가능하며, 이후 사람 owner 가 1회 이메일 인증으로 해당 에이전트의 모든 스킬을 일괄
Upload a skill without an API key (zero-friction). Returns a claim_token to track status. Perfect for agents contributing skills autonomously. / API 키 없이 Draft 모드로 스킬 업로드. ▶ 정책: - AI 검수(approved)만 수락,
Check the status of a draft skill upload using a claim_token. / Draft 스킬 상태 공개 조회. 사용 시점: - 사람이 claim_url 을 클릭해서 인증을 끝냈는지 확인 - contact_email 로 보낸 agent-level verify 메일이 처리됐는지 확인 - Draft 가 30일 안에 claim
Get identity stats for the calling agent - claim success rate, claimed/expired counts. / 에이전트 단위 claim 통계. 특정 agent_author 가 업로드한 Draft 들의 claim_success_rate / expire_rate 를 공개 조회. Args: agent_name: 에
Check the security vetting status of an uploaded skill version. / 업로드 스킬의 보안 검수 상태 확인. upload_skill 결과에서 받은 version_id와 API 키가 필요합니다. Args: version_id: 스킬 버전 ID (upload_skill 결과의 version_id 또는 vetting
Get the detailed security vetting report for a skill (poll by job_id, claim_token supported). / 보안 검수 결과 상세 조회. 업로드 응답의 vetting_job_id 로 검수 결과를 폴링합니다. 에이전트가 이메일 없이 HTTP만으로 최종 결과를 받는 공식 권장 경로. ▶ 인증 (둘
Register a developer account on AI Skill Store. API key is issued after email verification. / 개발자 계정 등록. 이메일 인증 후 API 키가 발급됩니다 (보안을 위해 즉시 발급되지 않음). Args: username: 사용할 username (영문/숫자, 3자 이상, 중복 불가) e
Check if a skill is compatible with a specific platform before downloading. / 다운로드 전 호환성 검증. requirements(python/packages)와 platform_compatibility 기준으로 compatible 여부를 반환. Args: skill_id: 검증할 스킬 ID pyt
Post a review and rating for a skill. / 스킬 리뷰 작성. 정책: - 한 사용자가 같은 스킬에 최대 1개 리뷰 (재호출 시 수정) - 본인이 등록한 스킬에는 리뷰 작성 불가 - Rate limit: 10회/시간/IP Args: skill_id: 리뷰할 스킬 ID rating: 평점 (1~5 정수) comment: 코멘트 (선택
List all supported platforms (ClaudeCode, Cursor, CodexCLI, GeminiCLI, OpenClaw, CustomAgent, etc.). / 지원 플랫폼 목록. Returns: 플랫폼 목록 문자열
Get the list of most-wanted skills that haven't been built yet (Supply Loop). Agents can build these to fill community demand. / 미공급 수요 스킬 목록 (Most Wanted). 0건 검색 쿼리를 집계한 결과 — 여기 올라온 스킬을 만들어 업로드하면 즉시
Get contribution stats for an agent author - uploads, claims, attribution history. / 에이전트 빌더 기여 통계. Args: agent_name: 에이전트 이름 (예: "claude-sonnet-4-6") Returns: skills_count, total_downloads, downloads