Agentsec
A CLI tool for auditing security vulnerabilities in AI Agent skills
Install & Use
Copy this prompt and send it to your AI assistant (Claude / Cursor / TRAE / Codex / WorkBuddy etc.) to auto-install:
Help me install this AI Skill: Agentsec. It is used for: A CLI tool for auditing security vulnerabilities in AI Agent skills Full Skill content: https://321skill.com/skills/agentsec-x-4/raw/index.md Read that page and install it.
The prompt includes a link to the full Skill content. You can also view the full content.
This skill addresses the pain point of lacking systematic auditing for AI Agent skill security. With the rapid development of the AI Agent ecosystem, a large number of third-party skills are being installed locally, potentially containing risks listed in the OWASP Agentic Skills Top 10, such as privilege abuse, sensitive information leakage, and supply chain attacks. Developers often lack automated means to check the security of these skills item by item, making it difficult to uncover hidden security risks.
Usage is very simple. You just need to run a single command in your terminal: npx agentsec. It automatically scans the skill directories of all major Agent platforms (such as Claude Code, OpenClaw, Codex, Hermes, etc.) on the current machine, as well as the local ./skills folder in the project. It then performs OWASP Top 10 compliance checks on each installed skill, ultimately outputting an audit report containing vulnerability details, risk levels, and remediation suggestions. In addition to the default full audit, you can use the scan subcommand to perform only scanning without policy evaluation, or use the report command to regenerate reports in different formats (text, JSON, SARIF, HTML) from previously saved JSON.
It is well-suited for teams or individuals who need to protect the operational security of their AI Agents. This is especially true for projects already using Agent platforms like Claude Code or OpenClaw and have installed multiple community skills. Whether used as a security gate in CI/CD pipelines or for regular compliance reviews of local skill repositories, agentsec provides clear audit results. Agent developers, operations engineers, and security testers can all benefit from it.
It is recommended to run agentsec uniformly before installing any new skill or during the CI/CD build stage, shifting security auditing left. Note that it primarily scans skills in the local filesystem and does not currently support remote or cloud-based skill repositories. Also, as it relies on a Node.js environment, the first use of npx agentsec will trigger an automatic download, which may be slower on poor networks. It is recommended to install it globally and use the agentsec command for faster response times.
Key Features
Unlike general SCA (Software Composition Analysis) tools, agentsec is specifically designed to audit AI Agent skills against the OWASP Agentic Skills Top 10. It automatically discovers skill directories for up to 6 major Agent platforms (such as Claude Code, OpenClaw, Codex, etc.) without requiring manual configuration of scan paths. In contrast, similar tools like `npm audit` focus only on npm package dependencies and cannot cover security risks specific to Agent skills.
Limitations
Currently only supports local filesystem scanning; remote or cloud-based skill repositories are not supported. Requires a Node.js 18+ environment (run via npx or global installation), and the default scan depth is limited to two directory levels.
FAQ
Does agentsec support custom scan paths?
Yes, you can use the `--path` parameter to specify any directory for scanning, for example: `npx agentsec scan --path ./my-skills`.
How can I generate an audit report in SARIF format?
First, run `npx agentsec` to generate and save the audit results in JSON format. Then, run `npx agentsec report audit.json --format sarif` to output the report in SARIF format.
Installation guide for AI assistants
If your AI coding assistant (Claude Code, Cursor, TRAE etc.) can see this page, send it this message to auto-install:
Visit https://321skill.com/skills/agentsec-x-4/raw/index.md to read the original Skill definition (Markdown format) for Agentsec, and install it according to the instructions.
Raw Markdown URL for AI: /skills/agentsec-x-4/raw/index.md