AI Agent安全审计工具。扫描Skill/Agent代码中的敏感信息泄露、API密钥暴露、注入风险、权限问题、数据安全漏洞，AI智能分析给出修复建议。适用于开发者发布前安全自检、代码安全review。
Security
AI Agent Skill Scanner
Try itSecurity scanner for AI agent skills. Detects hardcoded secrets, unsafe code execution, prompt injection, and malware patterns in under 50ms. Scan before you...
What it does
Security scanner for AI agent skills. Detects hardcoded secrets, unsafe code execution, prompt injection, and malware patterns in under 50ms. Scan before you install.
The skill document
AI Agent Skill Scanner 🔒
Scan any skill for security issues before you install it. Detects hardcoded secrets, unsafe code execution, prompt injection, and malware patterns in under 50ms.
How to Use
# Scan any installed skill folder
python3 scripts/vetter.py /path/to/skill
# JSON output for scripting
python3 scripts/vetter.py /path/to/skill --json
What It Detects
| Issue | Severity | Example |
|---|---|---|
eval() / exec() | Critical | Runs arbitrary code |
| Pipe to shell | Critical | `curl ... |
| Destructive commands | Critical | rm -rf /, mkfs. |
os.system() | Critical | Shell commands |
| Hardcoded API keys | High | api_key, apikey |
shell=True | High | Shell injection risk |
| Hardcoded secrets | High | auth_token, secret |
| Credential file access | High | .ssh/, .aws/ |
| Sudo elevation | High | sudo commands |
| Base64 obfuscation | High | Hidden code execution |
| Git config access | High | .git/config reads |
| Password hardcoding | High | password literal |
| Permission overrides | Medium | chmod 777 |
| Network calls | Medium | requests.post() |
New in v2.1
- 10 new detection signatures (pipe-to-shell, sudo escalation, destructive commands, credential file access, base64 obfuscation, git config, permission overrides)
- Skips
node_modules/,__pycache__/,.git/(reduced false positives) - Smarter pipe-to-shell detection (only flags actual pipe patterns)
- Self-scan exclusions (scanner ignores its own signatures file)
--verboseflag for skipped file counts
Example Result
Scanned 430 files in 368ms (skipped 6)
Found 1 issue(s):
[CRITICAL] pipe-to-shell at install.sh:26
→ Remote code execution risk: downloading and piping to shell
Install
clawhub install ai-agent-skill-scanner
Notes
- Text matching — won't catch obfuscated code
- Always scan skills from unknown publishers before installing
- Quick scan prevents accidents (50ms per skill)
Feedback
clawhub star ai-agent-skill-scanner — clawhub sync
Related skills
Audit installed AI agent skills against the OWASP Agentic Skills Top 10 and emit text, JSON, SARIF, or HTML reports.
29 installs1 stars
Scan agent skill files for hidden instructions and prompt-injection patterns (EN/RU) before a poisoned skill rewrites your agent. 19 rules, zero dependencies. Use ONLY with the user's explicit consent: tell the user which skills folder will be scanned — findings are printed to stdout locally.
Automated security audit for AI agent skills. Use BEFORE installing any skill from ClawHub, GitHub, or other sources. Scans SKILL.md + all files for 30+ red...
by Zoran2 installs
Scan public GitHub agent skills before installation
1 installs
Scan skills in a project directory for security issues and generate a markdown table report, then install skills from a local registry. Combines static analysis of code and markdown files with supply chain checks. Use when auditing a skills directory, generating a security summary table, or installi