@AverageAiBro highlighted ondrej-merkun/skill-audit, a local scanner for prompt-injection and malware patterns across Claude Code, Codex, Copilot, Cursor, Gemini CLI, Windsurf, Cline, AGENTS.md, installed skills, plugins, and MCP configs. It ships 46 rules with no cloud upload, optional deeper review through localhost OpenAI-compatible models, CI support via --fail-on REVIEW, and a GitHub Action under the @ondrej-merkun/skill-audit npm package.

Key Takeaways

  • ✓Scans skills, plugins, MCP configs, and AGENTS.md locally across major coding-agent clients.
  • ✓Forty-six rules detect prompt injection and malware patterns without uploading configs to the cloud.
  • ✓Supports --fail-on REVIEW, a GitHub Action, and optional localhost model review for install and CI gates.
⚡

Key Decision Metrics at a Glance

TL;DR Verdict
🏆 Benchmark RankRank
No model benchmark in this story · see current rankings
Full Leaderboard→
💰 Cost & PlansCompare
API & Subscription
Compare Plans↗
🛠️ Ecosystem & IDERules
Claude Code (Anthropic) · Cursor Composer (Agent Mode) · Cline (VS Code Agent)
Setup IDE Rules↗
🧭

Heavy Claude Code use: compare subscription limits and API bills

Compare 40 dev plans & simulate token costs vs $20/mo subscriptions

⚔️ Compare Model→💰 Compare plans & limits↗
Action HubReady to adopt this in production?

Benchmark side-by-side against alternatives, or calculate monthly token cost vs subscription break-even.

⚔️ Launch VS Compare→💳 View Plans↗
Up NextChainguard ships four MCP servers so coding agents verify images, APKs, EOL status and policy live—server-side governance instead of prompt guardrails
Read Now→