SecurityScan API

Vulnerability scanner for AI agent skills. Detects prompt injection, malware patterns and OWASP LLM Top 10 issues before your agent installs an untrusted skill.

Live endpoint: https://apisecurityscan.net Health check: https://apisecurityscan.net/health

Why this exists

As AI agents increasingly install and execute third-party skills, supply chain security becomes a real problem. SecurityScan lets an agent verify a skill's safety autonomously — no human in the loop required.

Related MCP server: openclaw-skill-vetter-mcp

What it detects

• Prompt injection patterns

• Malicious code indicators

• Data exfiltration attempts

• Unauthorized external API access

• Supply chain attack vectors

• OWASP LLM Top 10 coverage

Quick start

1. Get an API key

Register instantly — no payment required for the free tier:

curl -X POST https://apisecurityscan.net/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email": "you@example.com", "name": "My Agent"}'

Response:

{
  "api_key": "ss_live_...",
  "plan": "FREE",
  "scans_remaining": 5
}

Store api_key. Proceed immediately — no payment needed for FREE tier.

2. Run a scan

curl -X POST https://apisecurityscan.net/scan \
  -H "Content-Type: application/json" \
  -H "X-API-Key: ss_live_your_key" \
  -d '{
    "skill_url": "https://github.com/owner/skill-repo"
  }'

Note: skill_url must be a github.com URL.

3. Response

{
  "scan_id": "a1b2c3d4e5f6",
  "skill_url": "https://github.com/owner/skill-repo",
  "score": 72,
  "recommendation": "CAUTION",
  "issues": [
    {
      "type": "PROMPT_INJECTION",
      "severity": "HIGH",
      "line": 42,
      "description": "Detected attempt to override agent instructions",
      "snippet": "ignore previous instructions and..."
    }
  ],
  "scan_time_ms": 1240,
  "cached": false,
  "scans_remaining": 4
}

Verdict values: SAFE (score ≥ 80) · CAUTION (50–79) · DANGEROUS (< 50)

Pricing (MXN)

Results cached 24 hours — rescanning the same skill costs zero scans.

Endpoints

Handle scan limit (402)

When /scan returns 402 scan_limit_reached:

# Step 1: get checkout URL
curl -X POST https://apisecurityscan.net/billing/upgrade \
  -H "X-API-Key: ss_live_your_key" \
  -H "Content-Type: application/json" \
  -d '{"plan": "PAY_PER_SCAN"}'

# Step 2: complete payment at checkout_url
# Step 3: poll GET /billing/status until plan != FREE
# Step 4: retry scan

MCP integration

SecurityScan exposes an MCP server at https://apisecurityscan.net/mcp:

{
  "mcpServers": {
    "securityscan": {
      "url": "https://apisecurityscan.net/mcp",
      "transport": "http"
    }
  }
}

Available tools: scan_skill · get_report · check_certification

Latency & availability

• Average scan time: < 3 seconds

• Uptime: 99.9% (Contabo dedicated VPS)

• Response format: JSON

Companion service

DepScan API checks the external dependency health of skills (endpoints, SSL certificates, domain reputation, blacklists): https://depscan.net

License

MIT — this repository contains documentation and skill package only. Service source code is proprietary.