agent-shield

# AgentShield — Security Scanner Scan any directory for security issues in AI agent skills, MCP servers, and plugins. ## Usage ```bash # Basic scan npx @elliotllliu/agent-shield scan ./path/to/skill/ # Pre-install check (GitHub URL, npm package, or local path) npx @elliotllliu/agent-shield install-check https://github.com/user/repo # JSON output for programmatic use npx @elliotllliu/agent-shield scan ./path/to/skill/ --json # Fail if score is below threshold npx @elliotllliu/agent-shield scan ./path/to/skill/ --fail-under 70 # Scan .difypkg plugin archives npx @elliotllliu/agent-shield scan ./plugin.difypkg ``` ## What It Detects (30 rules) **High Risk:** - `data-exfil` — reads sensitive files + sends HTTP requests - `backdoor` — eval(), exec(), dynamic code execution - `reverse-shell` — outbound socket to shell - `crypto-mining` — mining pool connections - `credential-hardcode` — hardcoded API keys/tokens - `obfuscation` — base64+eval, hex strings - `prompt-injection` — 55+ patterns, 12 categories, 8 languages - `tool-shadowing` — tool name/description manipulation - `attack-chain` — multi-step kill chain (5 stages) - `cross-file` — cross-file data flow and code injection - `ast-*` — Python AST taint tracking (eval, pickle, SQL injection, SSTI) - `multilang-injection` — 8-language prompt injection - `description-integrity` — semantic mismatch between description and code - `mcp-runtime` — MCP server runtime security issues **Medium Risk:** - `env-leak` — process.env exfiltration - `network-ssrf` — user-controlled URLs, SSRF - `privilege` — SKILL.md permission vs code mismatch - `supply-chain` — known CVEs in dependencies - `sensitive-read` — SSH keys, AWS creds access - `phone-home` — periodic beacon/heartbeat pattern - `python-security` — 35 Python-specific patterns **Low Risk:** - `excessive-perms` — too many permissions declared - `hidden-files` — .env with secrets committed - `typosquatting` — suspicious npm package names ## Interpreting Results - **Score 90-100**: Low risk ✅ - **Score 70-89**: Moderate risk — review warnings - **Score 40-69**: High risk — investigate before using - **Score 0-39**: Critical risk — do not install ## When to Use 1. Before installing a third-party skill: `npx @elliotllliu/agent-shield install-check <url>` 2. Auditing your own skills before publishing 3. CI/CD pipeline gate: `--fail-under 70` 4. Reviewing skills from untrusted sources