SkillsGuard

開発を支援する SkillsGuardがパイプラインを保護しているなら、継続的な研究と新しい検出ルールを支援することを検討してください。 ETH寄付ウォレット 0x11282eE5726B3370c8B480e321b3B2aA13686582 QRコードをスキャンするか、上記のウォレットアドレスをコピーしてください。 AIエージェントスキルパッケージ向け静的セキュリティスキャナー。 悪意のあるSKILL.mdファイルやバンドルされたスクリプトを実行前に検出します。 "スキルを監査し、何も信頼せず、安全に出荷する。" ⚡ 60秒でインストール＆使用 オプションA —...

agent-scan

Snyk Agent Scan マシン上のエージェントコンポーネントを検出し、プロンプトインジェクションや脆弱性（エージェント、MCPサーバー、スキルを含む）をスキャンします。 注: CLI出力は試験的なものであり、予告なく変更されることがあります Agent Scan v0.5.x（廃止予定） このCLIの生の出力（issueコード、フィールド名、重大度ラベル、レスポンス構造を含む）は試験的なものであり、リリース間で予告なく変更される可能性があります。特定のCLI出力フィールドやissueコードに依存する本番ワークフローを構築することはお勧めしません。 Agent Scan v0.6以...

SkillSpector

SkillSpector Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks before installing agent skills. Overview AI agent skills used by Claude Code, Codex CLI, Gemini CLI, etc. execute with implicit trust and minimal vetting. Research shows that 26.1% of...

agent-skills

Elastic Agent Skills Elastic Agent Skills — Elasticを開発したチームによって構築された — は、ネイティブなプラットフォームの専門知識をAIコーディングエージェントに直接提供します。これは公式のAgent Skillsライブラリであり、Cursor、GitHub Copilot、Windsurf、Gemini CLIなどのエージェント型IDEと互換性があります。スキルはAgent Skillsオープン標準に従います。 !NOTE テクニカルプレビュー...

agent-scan v0.6.1

Snyk Agent Scan Discover and scan agent components on your machine for prompt injections and vulnerabilities including agents, MCP servers, skills. Note: CLI output is experimental and subject to change Agent Scan v0.5.x planned for deprecation The raw output of this CLI — including issue codes,...

ctf-skills

ctf-skills Agent Skills for solving CTF challenges — web exploitation, binary pwn, crypto, reverse engineering, forensics, OSINT, and more. Works with any tool that supports the Agent Skills spec, including Claude Code. インストールbash npx skills add ljagiello/ctf-skills root@kitploit: Friday Studio...

vet

クイックスタート • ドキュメント • コミュニティ !NOTE vet はエージェントスキルの特別モードをサポートしています。 GitHub リポジトリでホストされているエージェントスキルをスキャンするには、vet scan --agent-skill を実行してください。 vet を選ぶ理由 現代のソフトウェアの70～90%はオープンソースコードです — それが安全であるとどうやって確認しますか？ 従来のSCAツールはCVEのノイズで埋もれてしまいます。vet は異なるアプローチをとります： シャドウ AI 発見 — さまざまなツールや設定からAIツール使用のシグナルを発見...

awesome-web3-security — Updated!

awesome-web3-security A curated list of Web3 Security materials and resources for Pentesters and Bug Hunters. root@kitploit: If you find that some links are not working, you can simply replace the username with gmh5225. Or you can send an issue for me. Show respect to all the projects below,...

Agent-Skills-Security-Standard

このリポジトリには README がありません。...

awesome-ai-security — Updated!

awesome-ai-security A curated list of AI Security materials and resources for Pentesters, Bug Hunters, and Security Researchers. root@kitploit: If you find that some links are not working, you can simply replace the username with gmh5225. Or you can send an issue for me. Show respect to all the...

Awesome-LLMs-for-Vulnerability-Detection

Awesome Large Language Models for Vulnerability Detection A curated list of papers, projects, and agent skills on using LLMs for vulnerability detection and discovery. 📄 Papers Only showing 2025 and later. For earlier work, see Papers Archive 2024 and earlier...

Runtime Skill Audit: Targeted Runtime Probing for Agent Skill Security

Agent skills let LLM agents reuse instructions, resources, tools, and workflows, but they also create a new place for malicious behavior to hide. A skill may look benign in its documentation or code while becoming harmful only when it is invoked with particular user requests, local assets,...

MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent Skills

AI coding agents such as Claude Code and Gemini CLI increasingly extend themselves with third-party skills: markdown packages bundling natural-language instructions, executable scripts, and tool permissions. Because a skill is at once code and agent-facing instruction, it introduces a supply chai...

SkillGuard: A Permission Framework for Agent Skills

Agent skills extend LLM agents with reusable instructions, scripts, tool bindings, and contextual dependencies. However, current skill ecosystems largely rely on trust-based loading and static inspection, leaving a gap between what a skill can inject into an agent's context and what it can cause...

No Attack Required: Semantic Fuzzing for Specification Violations in Agent Skills

LLM-powered agents can silently delete documents, leak credentials, or transfer funds on a routine user request, not because the agent was attacked, but because the skill it invoked broke its own declared safety rules. We call these specification violations: benign inputs cause a skill to breach...

Proteus: A Self-Evolving Red Team for Agent Skill Ecosystems

Agent skills extend LLM agents with reusable instructions, tool interfaces, and executable code, and users increasingly install third-party skills from marketplaces, repositories, and community channels. Because a skill exposes both executable behavior and context-setting documentation, its...

Behavioral Integrity Verification for AI Agent Skills

Agent skills extend LLM agents with privileged third-party capabilities such as filesystem access, credentials, network calls, and shell execution. Existing safety work catches malicious prompts and risky runtime actions, but the skill artifact itself goes unverified. We formalize this as the...

Under the Hood of SKILL.Md: Semantic Supply-Chain Attacks on AI Agent Skill Registry

Autonomous AI agents increasingly extend their capabilities through Agent Skills: modular filesystem packages whose SKILL.md files describe when and how agents should use them. While this design enables scalable, on-demand capability expansion, it also introduces a semantic supply-chain risk in...

SkillScope: Toward Fine-Grained Least-Privilege Enforcement for Agent Skills

Agent Skills have become a practical way to extend LLM agents by packaging metadata, natural-language instructions, and executable resources into reusable capability bundles. However, this growing Skill ecosystem introduces a new compliance risk: a Skill may perform high-impact actions that excee...

Structured Security Auditing and Robustness Enhancement for Untrusted Agent Skills

Agent Skills package SKILL.md files, scripts, reference documents, and repository context into reusable capability units, turning pre-load auditing from single-prompt filtering into cross-file security review. Existing guardrails often flag risk but recover malicious intent inconsistently under...