Show HN: Aguara – Security scanner for AI agent skills and MCP servers

  Hey HN,

  I built Aguara because I kept seeing the same problem: AI agents and MCP servers
  run code on your behalf, and nobody is checking what that code actually does before
  it runs.

  A single malicious skill file can exfiltrate your SSH keys, inject prompts to
  override safety instructions, or curl-pipe-bash a backdoor. I wanted something
  like Semgrep but specifically for the AI agent ecosystem.

  Aguara is a Go binary that does static analysis on skill files (markdown,
  YAML, JSON configs). It's offline, deterministic, no LLM, no API keys needed.

  What it catches:
  - Prompt injection (instruction overrides, jailbreaks, delimiter injection)
  - Data exfiltration (webhook URLs, DNS tunneling, env var leaks)
  - Credential leaks (OpenAI/AWS/GCP keys, private keys, DB connection strings)
  - Supply-chain attacks (curl|bash, binary download+execute, unpinned npx)
  - MCP-specific threats (tool injection, privileged docker, shell metacharacters)
  - 138 rules across 15 categories total

  It goes beyond regex — there's NLP-based markdown structure analysis (using
  goldmark AST walking) to catch things like hidden instructions in HTML comments,
  and taint tracking to detect dangerous capability combinations (e.g., a skill
  that reads private data AND has network access).

  I also built Aguara Watch (https://watch.aguarascan.com/) which continuously
  scans 31,000+ public AI agent skills across 5 registries (skills.sh, ClawHub,
  PulseMCP, mcp.so, LobeHub). The scan data is open — you can query any skill's
  security report via a static JSON API.

  Some numbers from scanning the entire public ecosystem:
  - 31,330 skills scanned
  - ~2,330 with security findings (7.4%)
  - 448 critical findings (mostly curl|bash, hardcoded keys, jailbreak prompts)

Show HN: Aguara – Security scanner for AI agent skills and MCP servers
github.com

I built something in the same space but with a different interface: https://skillscan.chitacloud.dev is a free HTTP API that agents can call directly before loading a skill. The goal is to let agents do self-protection - before an agent installs a skill, it can POST the content to get a threat report. No CLI, no binary to install.

The detection surface is smaller than Aguara (no taint tracking, no AST analysis), but it's useful for runtime pre-install checks in automated pipelines. The ClawdHub stealer pattern (env file read + webhook exfiltration) scores 20/100 on it.

Looking at your 7.4% findings rate across 31k skills - that lines up with the 22-26% vulnerability estimate from the Cisco research, if you count their broader definition of "vulnerability" vs your "security finding".