Agentsec

This skill addresses the challenge of auditing the security of AI Agent skills. In practice, developers often need to install various AI Agent skills from the community or third parties. However, these skills may contain malicious code, have excessive permissions, or contain configuration flaws, lacking a unified security inspection mechanism.

Usage is straightforward: simply run npx agentsec in your project directory. It will automatically scan all installed AI Agent skills (supporting mainstream platforms like Claude Code, OpenClaw, Codex, etc.) and perform security vulnerability detection based on the OWASP Agentic Skills Top 10. You can then run npx agentsec scan for a scan-only operation, or use npx agentsec report audit.json to generate an audit report in various formats such as text, JSON, SARIF, and HTML, facilitating integration into CI/CD pipelines.

It is well-suited for teams or individuals who need to ensure the security of their AI Agents. This is especially true for developers already using AI coding assistants (like Claude, Cursor, etc.) who have installed multiple skill plugins, as well as for security auditors, operations, or testing personnel. They can perform security checks before skill execution to avoid introducing risks.

It is recommended to use this tool uniformly for security checks after each new skill installation or within CI/CD pipelines. Note that it primarily scans the skill directories in the local filesystem. You need to ensure a Node.js environment is installed (supporting npx or global installation), and the scan scope is limited to the current project and the default platform skill directories.