AI Agent安全审计工具。扫描Skill/Agent代码中的敏感信息泄露、API密钥暴露、注入风险、权限问题、数据安全漏洞，AI智能分析给出修复建议。适用于开发者发布前安全自检、代码安全review。
安全
AI Agent Skill Scanner
试用Security scanner for AI agent skills. Detects hardcoded secrets, unsafe code execution, prompt injection, and malware patterns in under 50ms. Scan before you...
它能做什么
Security scanner for AI agent skills. Detects hardcoded secrets, unsafe code execution, prompt injection, and malware patterns in under 50ms. Scan before you install.
技能文档
AI Agent Skill Scanner 🔒
Scan any skill for security issues before you install it. Detects hardcoded secrets, unsafe code execution, prompt injection, and malware patterns in under 50ms.
How to Use
# Scan any installed skill folder
python3 scripts/vetter.py /path/to/skill
# JSON output for scripting
python3 scripts/vetter.py /path/to/skill --json
What It Detects
| Issue | Severity | Example |
|---|---|---|
eval() / exec() | Critical | Runs arbitrary code |
| Pipe to shell | Critical | `curl ... |
| Destructive commands | Critical | rm -rf /, mkfs. |
os.system() | Critical | Shell commands |
| Hardcoded API keys | High | api_key, apikey |
shell=True | High | Shell injection risk |
| Hardcoded secrets | High | auth_token, secret |
| Credential file access | High | .ssh/, .aws/ |
| Sudo elevation | High | sudo commands |
| Base64 obfuscation | High | Hidden code execution |
| Git config access | High | .git/config reads |
| Password hardcoding | High | password literal |
| Permission overrides | Medium | chmod 777 |
| Network calls | Medium | requests.post() |
New in v2.1
- 10 new detection signatures (pipe-to-shell, sudo escalation, destructive commands, credential file access, base64 obfuscation, git config, permission overrides)
- Skips
node_modules/,__pycache__/,.git/(reduced false positives) - Smarter pipe-to-shell detection (only flags actual pipe patterns)
- Self-scan exclusions (scanner ignores its own signatures file)
--verboseflag for skipped file counts
Example Result
Scanned 430 files in 368ms (skipped 6)
Found 1 issue(s):
[CRITICAL] pipe-to-shell at install.sh:26
→ Remote code execution risk: downloading and piping to shell
Install
clawhub install ai-agent-skill-scanner
Notes
- Text matching — won't catch obfuscated code
- Always scan skills from unknown publishers before installing
- Quick scan prevents accidents (50ms per skill)
Feedback
clawhub star ai-agent-skill-scanner — clawhub sync
相关技能
按 OWASP Agentic Skills Top 10 审计已安装的 AI Agent 技能，输出文本、JSON、SARIF 或 HTML 报告。
29 次安装1 星标
Scan agent skill files for hidden instructions and prompt-injection patterns (EN/RU) before a poisoned skill rewrites your agent. 19 rules, zero dependencies. Use ONLY with the user's explicit consent: tell the user which skills folder will be scanned — findings are printed to stdout locally.
Automated security audit for AI agent skills. Use BEFORE installing any skill from ClawHub, GitHub, or other sources. Scans SKILL.md + all files for 30+ red...
作者 Zoran2 次安装
Scan public GitHub agent skills before installation
1 次安装
Scan skills in a project directory for security issues and generate a markdown table report, then install skills from a local registry. Combines static analysis of code and markdown files with supply chain checks. Use when auditing a skills directory, generating a security summary table, or installi