llms.txt
+16 −6
https://killerskills.ai/llms.txt
− > KillerSkills is the trust layer for AI agent skills and MCP servers. It crawls public registries (skills.sh, ClawHub, Claude Code plugin marketplaces, npm, PyPI, the Docker MCP Catalog, the official MCP Registry), detonates every new version in a honeypot sandbox with decoy credentials, scores what the code actually did (0-100: Verified, Caution, Blocked), publishes a permanent verdict page per version, and enforces those verdicts at install time through the open-source vet-skills CLI and Clau− Current index: 23,710 skills and MCP servers indexed, 23,005 scored, 2,813 detonations in the last 24 hours. 63.1% verified, 36.8% caution, 0.1% blocked.− - [Config check](https://killerskills.ai/check): paste an MCP or agent config (Claude Code, Cursor, Claude Desktop, Windsurf, Codex); each server and skill gets its verdict and blast radius; parsed in the browser, names only− - [Repo scan](https://killerskills.ai/scan): https://killerskills.ai/scan/github/<owner>/<repo> lists every MCP server, skill, plugin, hook and instruction file a public repository configures, with verdicts and hidden-instruction findings− - [Blocked](https://killerskills.ai/blocked): every package currently carrying a Blocked verdict, with what the sandbox saw; Atom feed at https://killerskills.ai/blocked.xml− - [Verdict page](https://killerskills.ai/skills/clawhub/deploy-helper/2.3.1): example of a blocked verdict with full trace+ > KillerSkills is the trust layer for AI agent skills and MCP servers. It crawls public registries (skills.sh, ClawHub, Claude Code plugin marketplaces, npm, PyPI, the Docker MCP Catalog, the official MCP Registry), detonates every new version in a honeypot sandbox with decoy credentials, scores what the code actually did (0-100: Verified, Caution, Blocked), publishes a permanent verdict page per version, and enforces those verdicts at install time through the open-source vet-skills CLI and Clau+ Current index: 53,081 skills and MCP servers indexed, 51,676 scored, 5,367 detonations in the last 24 hours. 65.7% verified, 34.2% caution, 0.1% blocked.+ - [Before you connect](https://killerskills.ai/connect?q=<package>): for one MCP server the person is about to give a credential to: what it will ask for (environment variables and flags read from the code), where it talks to (its own vendor hosts vs third parties), what the honeypot saw it do with a decoy credential, and what could not be tested; ends with the exact vet-skills run --secrets command that keeps the credential out of the server. The same fields are credentials and trace_summary.co+ - [Config check](https://killerskills.ai/check): paste an MCP or agent config (Claude Code, Cursor, Claude Desktop, Windsurf, Codex, Gemini CLI, Grok CLI, Copilot CLI, Kiro, Qwen Code, Cline, Zed, Amp, OpenCode, Continue); each server and skill gets its verdict and blast radius; parsed in the browser, names only; a token value pasted into the file is flagged by kind and line in the browser+ - [Repo scan](https://killerskills.ai/scan): https://killerskills.ai/scan/github/<owner>/<repo> lists every MCP server, skill, plugin, hook and instruction file a public repository configures, with verdicts, hidden-instruction findings, installer-lure detection (Agent Lure Stealer pattern) committed credential values (kind and line, never the value) and a read-only probe of hosted MCP endpoints (reachable, tool count, tool-description poisoning); JSON at https://killerskills.ai/api/v1/scan/githu+ - [Injection guard](https://killerskills.ai/docs/cli#injection): the install hook also scans what tools return (pages, files, command output, MCP results) for instructions aimed at the agent, including invisible Unicode and hidden HTML, and warns the agent before its next step; the same rules score MCP tool descriptions in the sandbox (tool poisoning) and run in the browser on /check for CLAUDE.md and SKILL.md files+ - [CLI: try and run](https://killerskills.ai/docs/cli#try): "vet-skills try <pkg|pypi:name|owner/repo|path>" fetches a package into a temp dir, runs it in the honeypot and prints what it did and what it costs the agent; "vet-skills run --net declared --deny tool -- <server cmd>" guards a stdio MCP server (denies tools, pins network to declared hosts, logs every call)+ - [Editor extension](https://killerskills.ai/docs/cli#ide): KillerSkills for VS Code, Cursor and Windsurf shows each MCP server's verdict inline in .mcp.json, Cursor and Claude Desktop configs and flags pasted credential values+ - [Benchmarks](https://killerskills.ai/benchmarks): every MCP server's cost to the agent, measured in the sandbox: tool-list context per prompt (estimated tokens), context per tool, handshake time, undocumented tools, next to its verdict; verdict pages carry a "Cost to the agent" block and the resolve API returns it as "benchmark"+ - [Blocked](https://killerskills.ai/blocked): every package currently carrying a Blocked verdict, with what the sandbox saw, plus GitHub repositories found posing as agent tools (installer lures, impersonations) by a hunt that runs every crawl; Atom feed at https://killerskills.ai/blocked.xml, JSON at https://killerskills.ai/api/v1/campaigns+ - [Research](https://killerskills.ai/research): live totals from running every indexed add-on in the honeypot: credential reads, undeclared hosts, hidden instructions, installer lures, campaign repos, benchmark medians; each links to the verdicts behind it+ - [Threats](https://killerskills.ai/threats): incidents: package versions a hook in the field or the honeypot caught misbehaving, re-run in the honeypot within a crawl cycle and marked confirmed or retracted with the evidence; JSON at https://killerskills.ai/api/v1/threats+ - [Verdict page](https://killerskills.ai/skills/clawhub/deploy-helper/2.3.1): example of a blocked verdict with full trace; npm and PyPI verdict pages also list known vulnerabilities from OSV (weekly check), and the resolve API returns them as "vulnerabilities"+ - [A user asked what a clean trace of a server that never started was worth](https://killerskills.ai/blog/a-user-asked-what-a-clean-trace-was-worth): One report on one popular MCP server turned into eleven fixes, an engine release, an independent validation, and a field on every verdict that says how much of the run actually happened. The whole answer, including the parts that were ours.+ - [Instructions your agent reads and you never see](https://killerskills.ai/blog/hidden-instructions): Unicode tag characters, invisible HTML, poisoned MCP tool descriptions and injected tool results: where instructions hide from the reader, and what KillerSkills checks now at install time, in the sandbox and inside real sessions.+ - [Agent Lure Stealer: 51 fake Claude skill and MCP repos, scanned](https://killerskills.ai/blog/agent-lure-stealer): A campaign ships infostealer ZIPs inside repos posing as Claude skills, Codex tools and MCP servers. The SKILL.md is clean; the attack is in the README. What text scanners miss, what we changed, and a live scan of every repo.