AI Agent Security Scanner

Problem

Multi-agent environments leave local configurations, scripts, MCP definitions, memory files, and skill files behind. Manual audits can miss hardcoded credentials, dangerous os.system or subprocess calls, suspicious data exfiltration URLs, prompt injection, MCP poisoning, and dependency supply-chain risks. The issue is not only malicious files, but scattered configs, behaviors, and dependencies across agent directories.

How It Works

The skill runs locally after license activation, then discovers targets:
- Built-in definitions: covers common AI coding and agent frameworks.
- Custom registry: add targets via config/custom_agents.json.
- General discovery: scans the user home directory and identifies unknown agents using markers such as MEMORY.md, AGENTS.md, mcp.json, agents/, and skills/.
It then executes 41 L1-L3 encrypted rules and 14 L4-L6 sensor rules, covering credential leakage, command execution, network requests, file operations, prompt injection, remote script execution, obfuscated encoding, supply-chain risk, MCP poisoning, and behavioral anomalies. It outputs self-contained HTML reports and structured JSON alert data, with date-based reports, incremental scans, and alert reuse.

Boundaries and Notes

The tool scans only agent data directories under the user home directory and does not access sensitive system paths such as /etc, /root, or Windows system directories; results remain in local HTML, JSON, and SQLite stores. Optional AI triage is disabled by default, and enabling it requires user-provided API endpoint and key configuration. The rule library is encrypted; --list-rules exposes the rule catalog, but concrete regex patterns are not published. Scheduled scans overwrite the current day's report while keeping date-named history.