ItsTrinabha

Moatkit — Security skill for Claude Code

Security community

Security toolkit for LLM apps and AI agents: blocks prompt injection, stops API keys and personal data leaking through the model, firewalls agent tool calls, and audits MCP/agent configs (Claude, Curs.

How to install Moatkit

This entry records only its repository, not the path inside it, so there is no exact command to give. Open ItsTrinabha/moatkit and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Moatkit does

Alternatives in Security

Trail Of Bits Claude-code-config — Opinionated production defaults from a top security firm: sandboxing, permissions, hooks, skills, MCP server c 1.6k ★
Promptmap — Security scanner for custom LLM apps 1.2k ★
ThinkWatch — Self-hosted AI API and MCP gateway for organizations: SSO and RBAC, per-user identity for MCP tool calls, PII 817 ★

README

moatkit

Install: `npm install @dixittrinabha/moatkit` (the CLI command is `moatkit`).

**A security toolkit for apps built on LLMs and for the AI agents on your machine.**

moatkit puts a moat around your AI app: it screens what goes into the model, what comes out of it, and what tools the model is allowed to call. It also audits the MCP and agent configs of Claude, Cursor, VS Code, Windsurf, Gemini CLI, Codex and others for risky setups.

Zero runtime dependencies. The core runs in Node, Bun, Deno, edge runtimes and the browser.
Fast. Prompt-injection screening averages ~0.65 ms per message. No network calls, no model.
Explainable. Every verdict lists the signals that fired and the text that matched.
Measured. Benchmarked on public, labelled datasets, with the method and results in `eval/RESULTS.md`.

npx @dixittrinabha/moatkit scan            # audit the AI agent / MCP configs in this repo
npx @dixittrinabha/moatkit scan --user     # ...and your global Claude/Cursor/VS Code/... configs
npm install @dixittrinabha/moatkit         # use the library in your app

Threat (OWASP Top 10 for LLM Apps 2025)	What moatkit gives you
LLM01 Prompt injection, direct and indirect	`detectInjection` (29 signals, de-obfuscation of base64/hex/leetspeak/homoglyphs/invisible Unicode), `spotlight` for untrusted documents
LLM02 Sensitive information disclosure	`scanLeaks` / `redact` (56 secret types, 15 checksum-validated PII types), reversible `createVault`, streaming redaction
LLM03 Supply chain	`moatkit scan`: unpinned/typosquatted/vulnerable MCP servers (live npm + PyPI advisories), rug-pull detection
LLM05 Improper output handling	`sanitizeOutput`: markdown-image exfiltration, data-carrying links, scripts, event handlers, hidden text
LLM06 Excessive agency	`checkToolCall`: firewall for agent tool calls (shell, SQL, paths, SSRF, secrets in arguments); "lethal trifecta" config anal