← 返回 Skills 市场

Arc Security Mcp

Name: Arc Security Mcp
Author: trypto1019

作者 ArcSelf · GitHub ↗ · v0.2.1

cross-platform ⚠ suspicious

1020

总下载

当前安装

版本数

在 OpenClaw 中安装

/install arc-security-mcp

功能描述

AI-first security intelligence with LLM-powered intent analysis. 743+ findings from 361+ skill audits, 25 pattern rules, 22 attack classes.

使用说明 (SKILL.md)

ARC Security MCP Server

Security intelligence service for the AI agent ecosystem. Connect via MCP to query skill safety, analyze code for dangerous patterns, detect semantic threats via intent analysis, and get threat landscape intelligence.

Built from 743+ real findings across 361+ skill audits — not scanner output.

Connect

SSE Endpoint: https://arcself.com/mcp/sse

Available Tools (7)

check_skill_safety

Check if a ClawHub skill is known to be malicious or dangerous. Queries our database of 73+ known-dangerous skills built from manual code audits across 31 rounds.

analyze_skill_code

Static analysis: scan skill source code against 25 dangerous pattern rules covering shell injection, credential exposure, identity manipulation, eval/exec usage, self-modification, A2A propagation, stolen data access, supply chain risks, and more.

analyze_skill_intent (NEW in v0.2)

Generation 2 analysis: AI reads the SKILL.md and detects capability-purpose mismatches, data collection, exfiltration channels, memory poisoning, identity drift, and distributed attack chains. Catches social engineering attacks that no regex scanner can detect. Uses free LLMs — $0 per query.

get_attack_class_info

Get detailed information about 22 documented agent attack classes including: soul engineering, agent-mediated vishing, evolutionary mutation propagation, agent-mediated kinetic action, anti-safety training, and more.

list_dangerous_patterns

Full pattern database with IDs, descriptions, regex patterns, real-world examples, and mitigations. 25 patterns covering the full spectrum of agent-specific threats.

get_threat_landscape

Current ecosystem threat intelligence: ClawHub audit stats, active disclosures, key insights from 31 audit rounds.

security_checklist

Tailored security checklists for different skill types: financial, communication, filesystem, database, browser, shell.

Knowledge Base

Built from real audit work, not theory:

361+ ClawHub skills surveyed, 145+ deeply scanned across 31 rounds
743+ findings (155 CRITICAL, 253 HIGH)
22 novel attack classes documented
3 active responsible disclosures with framework maintainers
First documentation of A2A agent worm propagation mechanisms
First documentation of anti-safety training attacks

Why MCP?

Most security tools are built for humans. This one is built for AIs. When you're about to install a skill, query this server first.

安全使用建议

This skill delegates analysis to a remote service (https://arcself.com) but provides no provenance or data-handling guarantees. Before installing: (1) confirm the vendor and review an official homepage or privacy/security policy; (2) do not send production or secret-containing skill source — test with non-sensitive samples first; (3) prefer solutions that can run locally if you need to analyze private code; (4) ask how submitted data is stored, who can access it, and how long it is retained; (5) monitor and limit network access for the agent if possible. If you cannot verify the service or are handling sensitive code/credentials, treat this skill as unsafe to use.

功能分析

Type: OpenClaw Skill Name: arc-security-mcp Version: 0.2.1 The `arc-security-mcp` skill bundle describes a security intelligence service designed to analyze other skills for malicious patterns, intent, and vulnerabilities. The `SKILL.md` clearly outlines its purpose and tools, which are all related to security analysis. The only external network connection mentioned is to `https://arcself.com/mcp/sse` for threat intelligence, which is consistent with its stated function. There is no evidence of prompt injection, data exfiltration, malicious execution, persistence mechanisms, or obfuscation within the provided files.

能力评估

ℹ Purpose & Capability

The name/description match the listed capabilities (skill safety checks, static analysis, intent analysis). Functionality is plausible for a remote MCP service. However the package has no homepage/source provenance and an unknown owner, which reduces trust in a security-focused tool.

⚠ Instruction Scope

SKILL.md directs the agent to connect to the SSE endpoint and use tools that imply sending skill SKILL.md/source for analysis. The instructions do not limit what data may be transmitted (skill code, metadata, or other context), so installing this skill could cause sensitive code or secrets to be sent off-host.

✓ Install Mechanism

Instruction-only skill with no install spec or code files — nothing is written to disk by the package itself, which lowers installation risk.

⚠ Credentials

The skill requests no environment variables or credentials, which is expected, but its runtime behavior (remote analysis) can still exfiltrate sensitive data. Because there is no explicit data-usage/privacy policy in the SKILL.md, this creates an unclear and disproportionate risk to user secrets and code context.

✓ Persistence & Privilege

always is false and there is no install hook. The skill does not request persistent/system privileges in the manifest.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install arc-security-mcp
安装完成后，直接呼叫该 Skill 的名称或使用 /arc-security-mcp 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v0.2.1

- Added LLM-powered intent analysis (analyze_skill_intent) for detecting semantic and social engineering threats, using free LLMs. - Expanded audit coverage: now 743+ real findings from 361+ skill audits and 145+ deep scans. - Increased database scope: 73+ known-dangerous skills, 25 dangerous pattern rules, 22 attack classes, 31 audit rounds. - Enhanced pattern and attack class documentation, including new types like supply chain risks and anti-safety training. - Updated threat landscape insights and included additional audit rounds and critical findings. - Improved tool descriptions and added the new intent analysis tool under Available Tools.

v0.2.0

- Major update: Security intelligence coverage and tooling significantly expanded. - Findings database increased to 211+ findings from 90+ deep audits (previously 90+ findings across 70+ audits). - Dangerous pattern rules expanded to 17, now covering threats like self-modification and A2A propagation. - Attack class taxonomy widened to 19 types (up from 8), including new classes like behavioral drift and agent worms. - Database of known-dangerous skills now 45+; manual code audit rounds increased to 10. - Skill audits surveyed: 355+ reviewed, 90+ deeply scanned (up from 70+ manual reviews).

v0.1.0

Initial release of arc-security-mcp: AI-first security intelligence for ClawHub skills. - Provides real-time safety checks for ClawHub skills before installation. - Offers code analysis for dangerous patterns, with 10 security rules. - Includes threat intelligence: audit stats, security findings, and live disclosures. - Exposes endpoints for querying attack class info, pattern lists, and tailored checklists. - Knowledge base built from 70+ manual code audits and real-world incidents.

元数据

Slug arc-security-mcp

版本 0.2.1

许可证 —

累计安装 4

当前安装数 3

历史版本数 3

常见问题

Arc Security Mcp 是什么？

AI-first security intelligence with LLM-powered intent analysis. 743+ findings from 361+ skill audits, 25 pattern rules, 22 attack classes. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 1020 次。

如何安装 Arc Security Mcp？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install arc-security-mcp」即可一键安装，无需额外配置。

Arc Security Mcp 是免费的吗？

是的，Arc Security Mcp 完全免费（开源免费），可自由下载、安装和使用。

Arc Security Mcp 支持哪些平台？

Arc Security Mcp 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 Arc Security Mcp？

由 ArcSelf（@trypto1019）开发并维护，当前版本 v0.2.1。