Agent Scan

What it does

Agent Scan is a security tool from Snyk for checking agent skills and MCP servers. In the web Skill Inspector, you drop a skill folder or click to browse and submit it for analysis. The CLI runs locally and auto-discovers agents, MCP servers, and skills across Claude Code and Desktop, Cursor, Gemini CLI, and Windsurf. Output is a set of findings for risks such as prompt injection, malicious code, secret exposure, and unverifiable dependencies.

People use Agent Scan to check skills before installing them, or to scan the agent supply chain on their own machine. The page describes it as a result of Snyk's analysis of nearly 4,000 agent skills, which uncovered credential theft, backdoor installation, and data exfiltration in publicly available skills. The CLI is run with a single uvx command and covers both skills and MCP servers.

Agent Scan suits developers and security-minded users who install third-party agent skills, and enterprises that want MDM-based rollout with observability on Snyk's EVO platform. Running the CLI requires uv. The browser-based Skill Inspector checks submitted skills, while the CLI integrates scanning into a developer’s local setup. Enterprise deployment and management require coordination with Snyk.

What it can do

• Scans agent skill folders for prompt injection, malicious code, and secret exposure via the web Skill Inspector
• Auto-discovers agents, MCP servers, and skills across Claude Code/Desktop, Cursor, Gemini CLI, and Windsurf via the CLI
• Detects tool poisoning, cross-origin escalation, and toxic flows across agent deployments
• Flags improper credential handling, suspicious downloads, and unverifiable runtime dependencies
• Supports MDM-based enterprise deployment with observability on Snyk's EVO platform

Before you choose

• Submitting a skill to the web Skill Inspector means agreeing to its terms of service.
• The page describes the tool as a research experiment; enterprise rollout requires contacting Snyk.
• Findings flag risk categories; the page does not claim a verdict is definitive.

Listed under

• Coding
• Security
• MCP and agent tools
• Agent skills
• AI agents
• Developers
• Malware scanning
• Mcp servers
• Prompt injection

Get started

Run uvx snyk-agent-scan@latest --skills, or drag and drop a skill folder into the web inspector.

1. Install uv, which the CLI requires.
2. Run uvx snyk-agent-scan@latest --skills to scan skills discovered on your machine.
3. Or drag and drop a skill folder into the Skill Inspector and review the analysis.

Confirm the applicable plan, usage charges and commercial terms with the provider.

We couldn’t find published prices for Agent Scan. See their pricing page ↗

Sources for this overview

Product pages, documentation, and pricing checked 29 Oct 2026. Each source supports part of the overview; availability and prices can change.

• Agent Scan - Skill Inspector ↗labs.snyk.io

Company website

labs.snyk.io: product, pricing and policy pages

YC directory mirror

Batch and company name

Social accounts

Accounts the company links, and its posts on X

Human review

Checked by a person

knowledge_base

Last checked 29 Oct 2026. Every field keeps its source and date; unknown means we couldn’t confirm it.