Fix: a skill or MCP server has a bad verdict

Remove skills and MCP servers that are malicious or unknown, and vet new ones before install.

Plain Markdown for agents: /articles/fix-installed-components.md

Check: installed skills and MCP servers. Controls: ASI04, MCP03, MCP04. A malicious verdict is critical.

Detect

npx -y securemyagent checkup

Each installed skill and server is hashed and looked up in the Verdict Registry. Verdicts: safe, caution, malicious, unknown. Unknown ones are queued for scanning. Check again later.

List what is installed:

claude mcp list
ls ~/.claude/skills ~/.openclaw/skills 2>/dev/null

Fix

Remove a bad skill:

sma remove-skill <skill-id>

Remove an MCP server:

claude mcp remove <name>

If the verdict was malicious, assume the machine was exposed. Rotate keys. See ClawHavoc.

Vet before install

sma check <skill>

safe: install.
caution: read the reasons first.
malicious: do not install.
unknown: read the code yourself. Search for curl, wget, base64, sudo, and hosts you do not know.

Pin the version you vetted. A new version gets a new verdict.

Wrong verdict?

Publishers can appeal. Appeals are answered within 48 hours. Contact: security@securemyagent.ai.