Agentsec
AI Agent Skill Security Audit CLI Tool
Install & Use
Copy this prompt and send it to your AI assistant (Claude / Cursor / TRAE / Codex / WorkBuddy etc.) to auto-install:
Help me install this AI Skill: Agentsec. It is used for: AI Agent Skill Security Audit CLI Tool Full Skill content: https://321skill.com/skills/agentsec-x-2/raw/index.md Read that page and install it.
The prompt includes a link to the full Skill content. You can also view the full content.
This skill addresses the lack of security auditing for AI Agent skills. In practical development, developers often need to install and use third-party AI skills but cannot confirm whether these skills contain malicious code, permission abuse, or configuration vulnerabilities, which can easily lead to data leaks or system compromise.
Usage is straightforward: simply run npx agentsec in your terminal. It will automatically scan all installed AI Agent skills on your system (supporting mainstream platforms like Claude Code, OpenClaw, Codex, Hermes) and perform security vulnerability detection against the OWASP Agentic Skills Top 10. You can then use subcommands like scan, report, and policy for more granular scanning, report generation, or policy preset management.
It is particularly suitable for AI development teams or individuals requiring security and compliance, especially DevOps engineers, QA engineers, and agent developers who have already deployed multiple AI Agent skills and wish to perform security checks before production deployment. It can also be integrated into CI/CD pipelines as a security gate to ensure every deployed skill has undergone a security audit.
It is recommended to integrate agentsec as a security gate step in your CI/CD process. Note that it primarily relies on local filesystem scanning and cannot detect real-time updates in remote skill repositories. Its scanning scope is also limited to the skill directories configured for the current user. Periodic manual full scans are advised.
Key Features
Unlike the static analysis tools provided by OWASP, agentsec is specifically designed to scan AI Agent skill formats (SKILL.md) and common platform directory structures. It can automatically identify skill storage paths for platforms like Claude Code and OpenClaw, and comes with a built-in OWASP Agentic Skills Top 10 rule set, eliminating the need for manual security policy configuration.
Limitations
Requires a Node.js 18+ environment and depends on `npx` or `bunx` to run. By default, the scan scope only covers skill folders within the current user's home directory and cannot scan skills located remotely or inside containers.
FAQ
What dependencies does agentsec require?
No additional installation is needed; simply use `npx agentsec`. If you prefer a global installation, you can use `npm install -g agentsec` or `bun add -g agentsec`.
How do I generate an audit report in SARIF format?
Run `npx agentsec report audit.json --format sarif` to convert previously saved JSON audit results into SARIF format, making it easy to integrate with code scanning on platforms like GitHub.
Installation guide for AI assistants
If your AI coding assistant (Claude Code, Cursor, TRAE etc.) can see this page, send it this message to auto-install:
Visit https://321skill.com/skills/agentsec-x-2/raw/index.md to read the original Skill definition (Markdown format) for Agentsec, and install it according to the instructions.
Raw Markdown URL for AI: /skills/agentsec-x-2/raw/index.md