agent-scan

Snyk Agent Scan Discover and scan agent components on your machine for prompt injections and vulnerabilities including agents, MCP servers, skills. Note: We don't publish an npm package for Agent Scan. Install it via uvx or as a standalone binary. Note: CLI output is experimental and subject to...

agent-skills

Elastic Agent Skills Elastic Agent Skills — Elastic を構築した人々によって作られた — は、ネイティブプラットフォームの専門知識を AI コーディングエージェントに直接提供します。これは公式の Agent Skills ライブラリであり、Cursor、GitHub Copilot、Windsurf、Gemini CLI などのエージェント型 IDE と互換性があります。スキルは Agent Skills オープン標準に準拠しています。 !NOTE テクニカルプレビュー...

Awesome-LLMs-for-Vulnerability-Detection

用于漏洞检测的大型语言模型精选列表 一份关于使用LLM进行漏洞检测与发现的论文、项目和智能体技能的精选列表。 📄 论文 仅展示2025年及以后的工作。更早的工作请参阅论文存档（2024年及以前）。 标题| 会议/期刊| 年份| 论文| Github ---|---|---|---|--- VulnGym: Benchmarking Coding Agents for Repository-Level Vulnerability Detection| | 2026| 链接| 链接 VulTriage: Triple-Path Context Augmentation for LLM-Bas...

vet

Quick Start • Documentation • Community !NOTE vet supports special mode for Agent Skills. Run vet scan --agent-skill to scan an Agent Skill hosted in a GitHub repository. Why vet? 70-90% of modern software is open source code — how do you know it's safe? Traditional SCA tools drown you in CVE...

SkillSpector

SkillSpector Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks before installing agent skills. Overview AI agent skills used by Claude Code, Codex CLI, Gemini CLI, etc. execute with implicit trust and minimal vetting. In the 31,132-skill analyzed...

ctf-skills

ctf-skills Agent Skills for solving CTF challenges — web exploitation, binary pwn, crypto, reverse engineering, forensics, OSINT, and more. Works with any tool that supports the Agent Skills spec, including Claude Code. インストールbash npx skills add ljagiello/ctf-skills Friday Studio で実行する...

SkillsGuard

支持开发 如果 SkillsGuard 保护了你的流水线，请考虑支持持续的研究和新的检测规则。 ETH 捐赠钱包 0x11282eE5726B3370c8B480e321b3B2aA13686582 扫描二维码或复制上方钱包地址。 AI 智能体技能包的静态安全扫描器。 在运行前检测恶意的 SKILL.md 文件和捆绑脚本。 “审计技能。不信任任何事物。安全交付。” ⚡ 60 秒内安装并使用 选项 A — 免费云 API（无需安装）bash Scan any SKILL.md with a single curl — no account, no key curl -s...

Agent-Skills-Security-Standard

此存储库没有 README。...

firmware-reverse-engineering

固件逆向工程技能 来自 OrbitCurve 的五个代理技能，涵盖固件提取、静态分析、Ghidra 逆向工程、仿真和安全报告，由 Hussein Muhaisen 提供。 该集合将现有的工作流程、参考资料、模板和 Ghidra 脚本打包，供 Claude Code 和 Codex 使用。安装后即可让您的代理获得这些指令；分析工具需单独安装。 验证： 包含 Claude Code 和 Codex 的打包/发现检查、Ghidra 脚本回归测试，以及选定的提取/报告检查。请参阅已测试版本和限制。固件仿真仍因目标而异。 技能 技能| 用途 ---|--- firmware-extraction|...

agent-scan v0.6.4-snapshot-6e2d290-1638

Snyk Agent Scan Discover and scan agent components on your machine for prompt injections and vulnerabilities including agents, MCP servers, skills. Note: We don't publish an npm package for Agent Scan. Install it via uvx or as a standalone binary. Note: CLI output is experimental and subject to...

AI-Infra-Guard v4.6.1

📖 Documentation | 🌐 🇨🇳 中文 · 🇯🇵 日本語 · 🇪🇸 Español · 🇩🇪 Deutsch · 🇫🇷 Français · 🇰🇷 한국어 · 🇧🇷 Português · 🇷🇺 Русский 🚀 AI Red Teaming Platform by Tencent Zhuque Lab A.I.G AI-Infra-Guard integrates capabilities such as ClawScanOpenClaw Security Scan, Agent Scan，AI infra vulnerability scan...

SkillSpector v2.11.1

SkillSpector Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks before installing agent skills. Overview AI agent skills used by Claude Code, Codex CLI, Gemini CLI, etc. execute with implicit trust and minimal vetting. In the 31,132-skill analyzed...

skill-scanner v2.0.14

Skill Scanner A best-effort security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code patterns. It combines pattern-based detection YAML + YARA-X, AST and dataflow analysis , an optional LLM-as-a-judge , and a bounded CEL decision layer over typed...

agent-skills v0.4.0

Elastic Agent Skills Elastic Agent Skills — built by the people who built Elastic — deliver native platform expertise directly to your AI coding agent. This is the official Agent Skills library, compatible with agentic IDEs such as Cursor, GitHub Copilot, Windsurf, Gemini CLI, and more. Skills...

agent-scan v0.6.1

Snyk Agent Scan Discover and scan agent components on your machine for prompt injections and vulnerabilities including agents, MCP servers, skills. Note: We don't publish an npm package for Agent Scan. Install it via uvx or as a standalone binary. Note: CLI output is experimental and subject to...

awesome-web3-security — Updated!

awesome-web3-security A curated list of Web3 Security materials and resources for Pentesters and Bug Hunters. If you find that some links are not working, you can simply replace the username with gmh5225. Or you can send an issue for me. Show respect to all the projects below, perfect works of ar...

awesome-ai-security — Updated!

awesome-ai-security A curated list of AI Security materials and resources for Pentesters, Bug Hunters, and Security Researchers. If you find that some links are not working, you can simply replace the username with gmh5225. Or you can send an issue for me. Show respect to all the projects below,...

PT-2026-59172

A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.23. Impacted is an unknown function of the file agent/skills guard.py of the component Skills Guard Multi-Word Prompt Handler. The manipulation of the argument THREAT PATTERNS leads to injection. Remote...

CVE-2026-15331: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was identified in zhayujie CowAgent up to 2.1.0. The affected element is the function addurl/addpackage of the file agent/skills/service.py of the component Skill Installation Handler. The manipulation of the argument Name leads to path traversal. The attack may be initiated...

Runtime Skill Audit: Targeted Runtime Probing for Agent Skill Security

Agent skills let LLM agents reuse instructions, resources, tools, and workflows, but they also create a new place for malicious behavior to hide. A skill may look benign in its documentation or code while becoming harmful only when it is invoked with particular user requests, local assets,...