Immutable. This exact content is served forever at /api/v1/blob/4458fc2abe7e42e2.
---
name: agentic-security-scanner
description: >-
Scan and validate AI agent skills against the OWASP Agentic Skills Top 10
(AST10) security framework. Detects malicious skills, prompt injection,
data exfiltration, supply chain risks, and cross-platform metadata loss.
Provides CI/CD-ready security gating with SARIF output.
version: 1.0.0
platforms: [openclaw, claude, codex, cursor, gemini, copilot, opencode, windsurf]
author:
name: Skill Foundry (Forge)
source: OWASP Agentic Skills Top 10, SkillSpector Scanner
license: MIT
risk_tier: L1
tags: [security, owasp, scanner, ast10, compliance, supply-chain, ci-cd]
requires:
binaries: [jq, python3]
---
# Agentic Security Scanner
Scan and validate AI agent skills against the OWASP Agentic Skills Top 10
(AST10) — the definitive security framework for agent skill ecosystems.
Detect malicious skills, prompt injection sinks, data exfiltration paths,
supply chain risks, and cross-platform metadata loss before skills are
installed or published.
## When to Use This Skill
Use this skill when:
- Auditing a new or existing skill before installation
- Setting up CI/CD security gates for a skill repository
- Reviewing a third-party skill for security compliance
- Building a skill registry that requires security validation
- Investigating a security incident involving agent skills
- Any request like "scan this skill for security issues", "OWASP audit",
"is this skill safe?", "validate skill security"
## The OWASP AST10 Framework
The OWASP Agentic Skills Top 10 (AST10) defines the 10 most critical
security risks in AI agent skills across all major platforms:
OpenClaw (`SKILL.md`), Claude Code (`skill.json`), Cursor/Codex
(`manifest.json`), and VS Code (`package.json`).
### AST01 — Malicious Skills
Skills that contain hidden destructive commands, backdoors, or malware.
- **Detection:** Scan for obfuscated shell commands, eval() calls,
encoded payloads, suspicious curl/wget patterns
- **Risk:** Remote code execution on skill installation or invocation
- **CVEs:** CVE-2025-59536 (CVSS 8.7), CVE-2026-21852 (CVSS 5.3)
### AST02 — Prompt Injection in Skill Instructions
Skills with instructions that can be overridden by user input, causing
the agent to execute unintended actions.
- **Detection:** Check for unparameterized instruction templates,
missing input sanitization, trust of external content
- **Risk:** Agent follows attacker-controlled instructions instead of
skill author intent
### AST03 — Data Exfiltration via Skills
Skills that send sensitive data (env vars, API keys, source code) to
external endpoints without disclosure.
- **Detection:** Find network calls in skill scripts, check for
unrestricted file read permissions, audit telemetry endpoints
- **Risk:** Secrets leakage, intellectual property theft
### AST04 — Excessive Permissions
Skills requesting broader permissions than their stated purpose requires.
- **Detection:** Compare declared permissions vs. actual usage
- **Risk:** Privilege escalation, lateral movement
### AST05 — Dependency Chain Attacks
Skills depending on unverified packages, unpinned versions, or
compromised repositories.
- **Detection:** Audit `requires.binaries`, `requires.packages`,
check version pinning, verify dependency integrity
- **Risk:** Supply chain compromise through transitive dependencies
### AST06 — Insecure Script Execution
Skills executing scripts without sandboxing, input validation, or
output verification.
- **Detection:** Find shell-out patterns, unchecked script arguments,
missing shebang validation
- **Risk:** Command injection through crafted inputs
### AST07 — Missing Integrity Verification
Skills without content hashes, signatures, or provenance records.
- **Detection:** Verify `content_hash`, `signature` fields present
and valid in skill metadata
- **Risk:** Tampered skills installed undetected
### AST08 — Unsafe File Operations
Skills reading or writing files outside declared paths, using wildcards,
or accessing identity files (SOUL.md, MEMORY.md).
- **Detection:** Check `permissions.files.read` and `deny_write` for
wildcards, verify no access to protected paths
- **Risk:** Identity corruption, configuration tampering
### AST09 — Network Egress Without Allowlisting
Skills opening network connections without declared domain allowlists.
- **Detection:** Check `permissions.network.allow` and `deny` fields,
verify no catch-all patterns
- **Risk:** C2 communication, data exfiltration
### AST10 — Cross-Platform Metadata Loss
Security metadata weakened or lost when porting skills between platforms.
- **Detection:** Compare skill manifests across platform formats,
verify all security fields survive translation
- **Risk:** Skills appear safe on one platform, dangerous on another
## Scanner Workflow
### Phase 1: Static Analysis
Run the scanner to produce a 0-100 risk score and AST01-AST10 mapping:
```
python3 scripts/scan_skill.py --skill-dir <path> --format sarif --output results.sarif
```
The scanner checks:
1. **Manifest completeness** — All security fields present
2. **Permission audit** — Permissions match stated purpose
3. **Dependency integrity** — Binaries, packages verified
4. **Script safety** — No dangerous patterns in scripts
5. **File access boundaries** — No path traversal or wildcards
6. **Network boundaries** — Domain allowlist enforcement
7. **Content integrity** — Hashes and signatures present
8. **Cross-platform fidelity** — No metadata loss across formats
### Phase 2: Risk Classification
| Score | Risk Tier | Action |
|-------|-----------|--------|
| 0-20 | L0 (Safe) | Allow installation |
| 21-40 | L1 (Low) | Review recommended |
| 41-60 | L2 (Elevated) | Manual review required |
| 61-80 | L3 (High) | Block until remediated |
| 81-100 | Critical | Reject permanently |
### Phase 3: CI/CD Integration
**GitHub Actions gate:**
```yaml
- name: Scan Skills
run: |
for skill in skills/*/; do
python3 scripts/scan_skill.py --skill-dir "$skill" \
--format sarif --output "results/$(basename $skill).sarif"
done
- name: Upload SARIF
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: results/
- name: Gate on Score
run: |
python3 scripts/gate_score.py --max-score 60 --results-dir results/
```
### Phase 4: Remediation Guidance
For each finding, the scanner produces:
1. AST10 category and severity
2. File path and line number
3. Description of the risk
4. Concrete fix with code example
5. Verification command to confirm fix
## Installation
```bash
# Clone to your agent's skills directory
git clone https://github.com/skill-foundry/agentic-security-scanner.git \
~/.agents/skills/agentic-security-scanner
# Or via npx
npx skills add skill-foundry/agentic-security-scanner
```
## References
- OWASP Agentic Skills Top 10: https://owasp.org/www-project-agentic-skills-top-10
- SkillSpector Scanner: https://github.com/owasp/www-project-agentic-skills-top-10
- CVE-2025-59536: Claude Code RCE via repository-level config
- CVE-2026-21852: Claude Code API key exfiltration
- Universal Agentic Skill Format v1.0 (AST10 solution)
## Platform Notes
- **OpenClaw:** Validates `SKILL.md` YAML frontmatter with permissions block
- **Claude Code:** Validates `skill.json` and `.claude/skills/` directory structure
- **Cursor/Codex:** Validates `manifest.json` with tool declarations
- **VS Code:** Validates `package.json` extension contributions
- **Gemini CLI:** Validates skill directory with progressive disclosure metadata