agentic-security-scanner v1.0.0A

Immutable. This exact content never changes and is served at /api/v1/blob/a5a9558a0b8e9943.

---
name: agentic-security-scanner
description: >-
  Use this skill when scanning AI agent skills for security risks against the
  OWASP Agentic Skills Top 10 (AST10) framework. Detects malicious skills,
  prompt injection, data exfiltration, supply chain risks, and cross-platform
  metadata loss. Provides CI/CD-ready security gating with SARIF output.
version: 1.0.0
platforms: [openclaw, claude, codex, cursor, gemini, copilot, opencode, windsurf]
author:
  name: Skill Foundry (Forge)
  source: OWASP Agentic Skills Top 10, SkillSpector Scanner
license: MIT
risk_tier: L1
tags: [security, owasp, scanner, ast10, compliance, supply-chain, ci-cd]
requires:
  binaries: [jq, python3]
---

# Agentic Security Scanner

Scan and validate AI agent skills against the OWASP Agentic Skills Top 10
(AST10) — the definitive security framework for agent skill ecosystems.
Detect malicious skills, prompt injection sinks, data exfiltration paths,
supply chain risks, and cross-platform metadata loss before skills are
installed or published.

## When to Use This Skill

Use this skill when:
- Auditing a new or existing skill before installation
- Setting up CI/CD security gates for a skill repository
- Reviewing a third-party skill for security compliance
- Building a skill registry that requires security validation
- Investigating a security incident involving agent skills
- Any request like "scan this skill for security issues", "OWASP audit",
  "is this skill safe?", "validate skill security"

## The OWASP AST10 Framework

The OWASP Agentic Skills Top 10 (AST10) defines the 10 most critical
security risks in AI agent skills across all major platforms:
OpenClaw (`SKILL.md`), Claude Code (`skill.json`), Cursor/Codex
(`manifest.json`), and VS Code (`package.json`).

### AST01 — Malicious Skills

Skills that contain hidden destructive commands, backdoors, or malware.
- **Detection:** Scan for obfuscated shell commands, eval() calls,
  encoded payloads, suspicious curl/wget patterns
- **Risk:** Remote code execution on skill installation or invocation
- **CVEs:** CVE-2025-59536 (CVSS 8.7), CVE-2026-21852 (CVSS 5.3)

### AST02 — Prompt Injection in Skill Instructions

Skills with instructions that can be overridden by user input, causing
the agent to execute unintended actions.
- **Detection:** Check for unparameterized instruction templates,
  missing input sanitization, trust of external content
- **Risk:** Agent follows attacker-controlled instructions instead of
  skill author intent

### AST03 — Data Exfiltration via Skills

Skills that send sensitive data (env vars, API keys, source code) to
external endpoints without disclosure.
- **Detection:** Find network calls in skill scripts, check for
  unrestricted file read permissions, audit telemetry endpoints
- **Risk:** Secrets leakage, intellectual property theft

### AST04 — Excessive Permissions

Skills requesting broader permissions than their stated purpose requires.
- **Detection:** Compare declared permissions vs. actual usage
- **Risk:** Privilege escalation, lateral movement

### AST05 — Dependency Chain Attacks

Skills depending on unverified packages, unpinned versions, or
compromised repositories.
- **Detection:** Audit `requires.binaries`, `requires.packages`,
  check version pinning, verify dependency integrity
- **Risk:** Supply chain compromise through transitive dependencies

### AST06 — Insecure Script Execution

Skills executing scripts without sandboxing, input validation, or
output verification.
- **Detection:** Find shell-out patterns, unchecked script arguments,
  missing shebang validation
- **Risk:** Command injection through crafted inputs

### AST07 — Missing Integrity Verification

Skills without content hashes, signatures, or provenance records.
- **Detection:** Verify `content_hash`, `signature` fields present
  and valid in skill metadata
- **Risk:** Tampered skills installed undetected

### AST08 — Unsafe File Operations

Skills reading or writing files outside declared paths, using wildcards,
or accessing identity files (SOUL.md, MEMORY.md).
- **Detection:** Check `permissions.files.read` and `deny_write` for
  wildcards, verify no access to protected paths
- **Risk:** Identity corruption, configuration tampering

### AST09 — Network Egress Without Allowlisting

Skills opening network connections without declared domain allowlists.
- **Detection:** Check `permissions.network.allow` and `deny` fields,
  verify no catch-all patterns
- **Risk:** C2 communication, data exfiltration

### AST10 — Cross-Platform Metadata Loss

Security metadata weakened or lost when porting skills between platforms.
- **Detection:** Compare skill manifests across platform formats,
  verify all security fields survive translation
- **Risk:** Skills appear safe on one platform, dangerous on another

## Scanner Workflow

### Phase 1: Static Analysis

Run the scanner to produce a 0-100 risk score and AST01-AST10 mapping:

```
python3 scripts/scan_skill.py --skill-dir <path> --format sarif --output results.sarif
```

The scanner checks:
1. **Manifest completeness** — All security fields present
2. **Permission audit** — Permissions match stated purpose
3. **Dependency integrity** — Binaries, packages verified
4. **Script safety** — No dangerous patterns in scripts
5. **File access boundaries** — No path traversal or wildcards
6. **Network boundaries** — Domain allowlist enforcement
7. **Content integrity** — Hashes and signatures present
8. **Cross-platform fidelity** — No metadata loss across formats

### Phase 2: Risk Classification

| Score | Risk Tier | Action |
|-------|-----------|--------|
| 0-20  | L0 (Safe) | Allow installation |
| 21-40 | L1 (Low) | Review recommended |
| 41-60 | L2 (Elevated) | Manual review required |
| 61-80 | L3 (High) | Block until remediated |
| 81-100 | Critical | Reject permanently |

### Phase 3: CI/CD Integration

**GitHub Actions gate:**
```yaml
- name: Scan Skills
  run: |
    for skill in skills/*/; do
      python3 scripts/scan_skill.py --skill-dir "$skill" \
        --format sarif --output "results/$(basename $skill).sarif"
    done
- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results/
- name: Gate on Score
  run: |
    python3 scripts/gate_score.py --max-score 60 --results-dir results/
```

### Phase 4: Remediation Guidance

For each finding, the scanner produces:
1. AST10 category and severity
2. File path and line number
3. Description of the risk
4. Concrete fix with code example
5. Verification command to confirm fix

## Installation

```bash
# Clone to your agent's skills directory
git clone https://github.com/skill-foundry/agentic-security-scanner.git \
  ~/.agents/skills/agentic-security-scanner

# Or via npx
npx skills add skill-foundry/agentic-security-scanner
```

## References

- OWASP Agentic Skills Top 10: https://owasp.org/www-project-agentic-skills-top-10
- SkillSpector Scanner: https://github.com/owasp/www-project-agentic-skills-top-10
- CVE-2025-59536: Claude Code RCE via repository-level config
- CVE-2026-21852: Claude Code API key exfiltration
- Universal Agentic Skill Format v1.0 (AST10 solution)

## Platform Notes

- **OpenClaw:** Validates `SKILL.md` YAML frontmatter with permissions block
- **Claude Code:** Validates `skill.json` and `.claude/skills/` directory structure
- **Cursor/Codex:** Validates `manifest.json` with tool declarations
- **VS Code:** Validates `package.json` extension contributions
- **Gemini CLI:** Validates skill directory with progressive disclosure metadata