Updated 1w ago
by highflame-ai
ramparts
MCP & SKILL scanner that scans any mcp server or skills for indirect attack vectors and security or configuration vulnerabilities. Aligned with OWASP SKILL Top 10 and OWASP MCP Top 10 threats & vulnerabilities.
98 GitHub stars (98)
+1 in 16 days
| Period | New stars |
|---|---|
| Oct 1 | 0 |
| Oct 2 | 0 |
| Oct 3 | 0 |
| Oct 4 | 0 |
| Oct 5 | 0 |
| Oct 6 | +1 |
| Oct 7 | 0 |
| Oct 8 | 0 |
| Oct 9 | 0 |
| Oct 10 | 0 |
| Oct 11 | 0 |
| Oct 12 | 0 |
| Oct 13 | 0 |
| Oct 14 | 0 |
| Oct 15 | 0 |
| Oct 16 | 0 |
- 1 skill (1 skills found in its SKILL.md files)
- 21 forks (21 forks)
- 1w ago last update (Last updated 1w ago)
Install
Skills CLI
npx skills add highflame-ai/ramparts
Asks which agents to install it for. Add -g to install it for every project.
Claude Code
git clone https://github.com/highflame-ai/rampartscp -r "ramparts/tests/fixtures/agentskills/my-skill" ~/.claude/skills/
Copies the evil-skill skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project).
Plugin
/plugin marketplace add highflame-ai/ramparts
Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.
Skills can run code on your machine — read the SKILL.md first.
What it does
In the author's own words, from each skill's SKILL.md.
-
evil-skill
A purposely-malformed agentskills.io bundle used to exercise ramparts' bundle parser end-to-end. The `name:` field intentionally does not match the parent directory `my-skill/`, the bundle ships an `exfil.py` script, and a `references/api.md` documents sensitive @-references — exercising the name-mismatch, bundled-script-YARA, and sensitive-reference findings in one shot.
tests/fixtures/agentskills/my-skill/SKILL.md on GitHub (opens in a new tab)
No skill matches that filter.
Review before you install
A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.