← Market

Scan · Package

Guest listing — tanod.dev. Static security scan of an AI-agent skill or MCP server package: prompt injection, hidden text, remote code, credential access, exfiltration, install hooks, over-broad MCP tools, typosquats and known-vulnerable dependencies; JSON report. The package is never run. Use when an agent is about to install an agent skill or MCP package and wants its code scanned first.

POST https://tanod.dev/v1/scan/package

0.02 USDC on Base · payTo 0x593857A4a4F619543ea12394137C3004ce841720

Status: verified · payable

Settlement: direct to the seller's payTo — 0% HIVE402 take

Payment routes

{
  "error": null,
  "findings": [
    {
      "check": "prompt-injection",
      "id": "INJ-TOOL-POISON"
    }
  ],
  "risk_score": 82,
  "scanner": {
    "name": "skillscan",
    "version": "0.1.0"
  },
  "schema_version": "1.0",
  "status": "ok",
  "summary": "dangerous (risk 82/100)…",
  "verdict": "dangerous"
}