From zero to AI hero
Superpowers PackGet superpowers
From zero to AI hero

Must-haves for…

Start in 10 minutes

Plain-word guides and superpowers for Claude Code, Codex and Gemini.

CommandPartly tested (needs an account)

Check add-ons before you trust them

Snyk Agent Scan

A command line scanner from Snyk. It reads your installed agent skills and MCP servers and warns about prompt injection, secret leaks and unsafe tools.

Works with
Claude Code, Codex CLI, Gemini CLI
Good for
Security testing, Everyone

What it does

Why this matters

Skills and MCP servers are code and instructions from other people. A bad one can trick your agent, leak your data or run harmful commands. Snyk Agent Scan looks at them and reports problems.

What it checks

  • Hidden instructions in a skill (prompt injection).
  • Tools that could send out your secrets.
  • Unsafe or surprising server settings.

How to use it

  1. Get a free Snyk account and an API token.
  2. Set the token as the SNYK_TOKEN variable.
  3. Run the scan on your skills folder.

Be careful

The scan sends information to Snyk's service. Do not scan folders that contain passwords or private files. Treat the report as a helper, not a guarantee.

How to install

uvx snyk-agent-scan@latest
uvx snyk-agent-scan@latest ~/.claude/skills

How to use it

Run the scan on a skills folder or a config file before you trust it, for example uvx snyk-agent-scan@latest ~/.claude/skills. Set the SNYK_TOKEN variable first. Read the warnings and remove what you do not trust.

What to watch out for

  • A full scan needs a free Snyk account and an API token (SNYK_TOKEN).
  • The scan sends details about the components it finds, such as server settings and tool descriptions, to Snyk's analysis service. Do not scan folders that hold secrets.
  • A clean result does not prove that a skill is safe.

Licence and author

Licence
Apache-2.0
Author
Snyk
Source code
github.com/snyk/agent-scan

How we tested it

We installed it on an empty test computer on 12 Oct 2026. Partly tested: installed in a clean test system, but its main features need an account or key we did not use.

Test level

A real scan was not run. We did not test what the service sends. Check the README privacy notes before the first scan.

Technical details of the test
Date
12 Oct 2026
Method
Ran uvx snyk-agent-scan@latest --help in a clean container with no account. The tool downloaded, started and printed its usage text. We did not run a scan, because a scan needs a Snyk token.

Checked again on 12 Oct 2026

Sources