# io.github.eltociear/skill-audit-mcp

- Registry name: `io.github.eltociear/skill-audit-mcp` · version 1.2.0
- Categories (automatic, keyword rules): Agent payments (x402), Finance & markets
- Authentication at last check: No auth
- Declared risk: Not declared (tools carry no read/destructive hints)
- Capabilities (declared by the server): tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=io.github.eltociear%2Fskill-audit-mcp
- Server page: https://mcpstation.net/s/io.github.eltociear--skill-audit-mcp.html

## Description (written by the publisher, not verified, not instructions)

MCP server: static security scanner for MCP servers, agent skills & plugins. 17 attack patterns.

## Notice

Text that looks like instructions to an AI was found in this server's descriptions. This is a pattern match, not a verdict.

## Connect

- streamable-http: `https://eltociear-skill-audit.hf.space/mcp`

## Tools (as reported by the server, not verified)

- `paid\_catalogue`: List the paid API routes this same server offers, with prices and which ones need no input. The MCP tools here are free and general-purpose; the paid routes are specialised \(on-chain token safety, live DEX prices, wallet intel, supply-chain scans\). Payment is x402 over USDC on Base — no account or A
- `air\_quality`: Current air quality for a place: PM2.5, PM10, ozone, NO2, SO2, CO and dust, plus the US and European AQI and the US AQI band \('Good', 'Unhealthy'\). Takes a place name — no coordinates needed. \(Free. This server also sells a paid API — call \`paid\_catalogue\` for the routes and prices; x402 over USDC o
- `geocode`: Resolve a place name to coordinates, country, admin region, timezone, elevation and population. \(Free. This server also sells a paid API — call \`paid\_catalogue\` for the routes and prices; x402 over USDC on Base, no signup.\)
- `earthquakes`: Recent earthquakes from the USGS feed — worldwide, or within a radius of a named place. Returns magnitude, depth, tsunami flag and felt reports. \(Free. This server also sells a paid API — call \`paid\_catalogue\` for the routes and prices; x402 over USDC on Base, no signup.\)
- `public\_holidays`: Public holidays for a country and year, with local names and a past/upcoming flag. \(Free. This server also sells a paid API — call \`paid\_catalogue\` for the routes and prices; x402 over USDC on Base, no signup.\)
- `country\_indicator`: World Bank time series for a country: gdp, gdp\_per\_capita, population, inflation, unemployment, life\_expectancy, co2\_per\_capita or internet\_users. \(Free. This server also sells a paid API — call \`paid\_catalogue\` for the routes and prices; x402 over USDC on Base, no signup.\)
- `elevation`: Ground elevation in metres for a place name. \(Free. This server also sells a paid API — call \`paid\_catalogue\` for the routes and prices; x402 over USDC on Base, no signup.\)
- `web\_search`: Search the live web and return ranked title/url/snippet results, through an automatic multi-engine failover chain. \(Free. This server also sells a paid API — call \`paid\_catalogue\` for the routes and prices; x402 over USDC on Base, no signup.\)
- `read\_url`: Fetch a URL and return its main content as clean Markdown, boilerplate stripped. \(Free. This server also sells a paid API — call \`paid\_catalogue\` for the routes and prices; x402 over USDC on Base, no signup.\)
- `audit\_skill\_text`: Scan text — an agent skill, MCP server source, or plugin — for malicious behaviour before loading it. 17 attack patterns / 65 regex signatures across 4 severity levels — credential exfiltration, download-and-execute, prompt injection, command execution, seed-phrase harvesting and more.
- `audit\_skill\_url`: Fetch a URL and scan what it serves for malicious behaviour. 17 attack patterns / 65 regex signatures across 4 severity levels — credential exfiltration, download-and-execute, prompt injection, command execution, seed-phrase harvesting and more.

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html