AI Agent Security

SkillSpector18.0k★

Agent skills are code you download from strangers and hand to an AI that has access to your machine. SkillSpector scans them before you do that. It checks Git repos, URLs, zip files, and local directories against 68 vulnerability patterns across 17 categories, covering prompt injection, data exfiltration, and supply-chain risk, then returns a 0-100 risk score with an install recommendation. Apache 2.0, from NVIDIA, no paid tier. Install is a Python 3.12 environment through uv, from source, or Docker if you would rather not touch Python at all. Static analysis needs no API key. The optional second stage sends the skill to an LLM for semantic review, which is where you supply your own provider key and pay that provider's rates. Output comes as terminal, JSON, Markdown, or SARIF, so it drops into CI without much glue. Free for everyone, and worth wiring into CI if your team installs skills from public repos. Baseline suppression keeps accepted findings from re-firing on every run. The catch is how you read the output. NVIDIA's own README reports vulnerabilities in 26.1% of skills scanned and likely malicious intent in 5.2%, which is a claim from the people selling the scanner, not an independent audit. Pattern matching also cannot prove safety. A clean scan means nothing known was found, not that a skill is safe to trust.

deepsec8.0k★

Deepsec is a security scanner that pays AI agents to find vulnerabilities the way a human auditor would. You point it at your repo, the agent reads the codebase, and it reports back with the kind of bugs that pattern-match scanners miss. The scan can cost thousands of dollars on a large codebase because it runs frontier models at maximum thinking depth. Apache 2.0, by Vercel Labs. Setup is npx deepsec init and a coding agent prompt to populate a project info file. From there, scans fan out across worker machines (or Vercel Sandbox microVMs for distributed runs). Jobs are idempotent, so an interrupted scan picks up where it left off. The model bill flows through Vercel AI Gateway or your own provider keys. Solo developers: probably overkill, and the model bill scares away curiosity scans. Use Snyk's free tier or Semgrep instead. Small teams shipping high-stakes code: a one-time scan of your auth layer or payment flow is in budget and finds real bugs. Large teams with security budgets: this is what you spend $30K on instead of a security consultant. The catch: the cost. A scan of a 100K-line monorepo with frontier models is real money. Read the FAQ before you launch one.

bumblebee5.0k★

Bumblebee answers one question fast: which of my machines have a known-compromised package installed? It's a read-only scanner from Perplexity that inventories what's on a developer's laptop or server, npm, PyPI, Go modules, RubyGems, Composer, browser and editor extensions, MCP configs, and flags anything matching a catalog of known-bad versions. Free, Apache-2.0, written in Go. The read-only part matters. It never runs a package manager, never reads your source, and deliberately won't print credential values out of MCP configs. It just reads lockfiles and metadata. That makes it safe to run across a fleet during an incident, which is exactly the job it's built for: supply-chain incident response, not continuous scanning. The catch: it's narrow on purpose. You supply the catalog of compromised packages, and Bumblebee matches against it. It won't find unknown vulnerabilities or do what a full SCA tool like Snyk does. For 'a bad package just hit the news, who's exposed,' it's perfect. For ongoing dependency security, it's not the whole answer.

nono4.2k★

Nono provides that. It's a capability-based sandbox where you explicitly grant each permission an agent gets. Basically, it's a bouncer for your operating system: the agent only gets through the doors you open. Capability-based means instead of blocking bad things (which requires knowing all bad things), you whitelist good things. The agent can only access files, network, and system calls you explicitly allow. Everything else is denied at the kernel level. Apache 2.0 licensed, Rust. The catch: kernel-level enforcement means Linux only, no macOS, no Windows. The capability model requires you to think carefully about what permissions each agent needs, which is more work upfront than just running Docker. And the documentation and community support are thin.

zeroboot2.5k★

Zeroboot spins up virtual machine sandboxes in under a millisecond using copy-on-write forking. That speed matters because agents need to spin up and tear down environments constantly, and traditional VMs take seconds to minutes. Sub-millisecond means your agent can create a fresh isolated environment for every single command it runs. No leftover state, no risk of one task contaminating another. It's like giving your agent a brand new computer for every action. Apache 2.0 licensed, Rust. The catch: this is Linux-only (it relies on kernel-level VM features). No macOS, no Windows. The sub-millisecond claim is for the VM fork. Actual workload startup depends on what you're running inside. And the community is small. If you hit an edge case, you're likely on your own.

fence976★

Fence sandboxes them without containers. It restricts network access and filesystem access at the OS level, so a rogue script can't phone home or delete your files. What's free: Everything. Apache 2.0 license. Single Go binary, no dependencies, no account. The value proposition is simplicity. Docker gives you isolation but requires the Docker daemon, images, and significant overhead. Fence is one binary. Run fence <command> and it executes with network and filesystem restrictions. That's it. For AI agent sandboxing, where you're running LLM-generated code and need guardrails, this is exactly the right weight class. The catch: it's brand new and early-stage. Linux only (uses kernel namespaces and seccomp). No macOS or Windows support. The security model is narrower than a full container. It restricts network and filesystem but doesn't provide complete process isolation. For high-security use cases, you still want containers or VMs. For 'don't let this script access the internet or my home directory,' it's perfect.

audit856★

audit is an automated vulnerability-discovery agent from evilsocket. Point it at a codebase and it runs an eight-stage pipeline, recon, hunt, validate, trace, report, using narrow AI agents that deliberately argue with each other: a second agent on a different model tries to disprove the first one's findings. MIT-licensed and free. The design borrows from Cloudflare's research that real bug-hunting needs many focused agents, not one giant model doing everything. It runs on your Claude Code subscription through the official Agent SDK, so there's no separate API key or metered bill if you already pay for Claude. Setup is more involved than a one-liner, and the agents run shell commands, so a disposable VM is the right call for untrusted code. The catch: this drives an LLM to find bugs, which means false positives and missed issues both happen. It's a force multiplier for a security reviewer, not a replacement for one. If you do code audits and already have Claude, it's worth a serious look. If you expect it to certify your code as safe on its own, that's not what this is.