Havuz

SkillSpector, AI agent skills paketlerini yüklemeden önce güvenlik riskleri açısından tarayan bir Python aracıdır.

Neden yükseliyor · AI agent skills ekosistemindeki güvenlik ihtiyacına doğrudan yanıt veriyor ve NVIDIA Verified Skills pipeline'ıyla bağlantılı. 191 günlük bir repo için 18.391 yıldızın yanı sıra son 28 günde 144 commit ve 24 farklı yazar, dikkat çekmenin yalnızca README iddialarına dayanmadığını gösteriyor.

NPMscan MCP Plugin

Self-hosted artifact repository manager written in Rust. Hosts, proxies and groups 30+ formats: Docker/OCI, Maven, npm, PyPI, Cargo, Go, Hel

Open-source antivirus and firewall for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugi

Open-source AI security verification for model artifacts, live endpoints, MCP servers, and recorded agent traces. Reproducible evidence for

A gh CLI extension that generates and verifies the GitHub Actions dependency lockfile, pinning every action your workflows use to an exact c

Offline cyber security agent for your apps and AI coding tools. Open R&D: measured in public, improved every release.

Agent skills from StarSling

Security-testing methodology as portable, tool-agnostic agent skills for Claude Code and any agent runtime: white-box bug hunting, AI-agent

Local security audit for AI API relays and LLM proxies: detects prompt injection, model substitution, tool-call rewriting, SSE anomalies, er

DSH plugin - framework upgrade safety & plugin gating: contract pre-check, rollback point, auto-rollback on failure, evidence-based auto-dis

Audits AUR PKGBUILD updates before you install: detects structural changes, suspicious commands, typosquatting, and novelty signals, then pr

Security scanner for MCP servers, source trees, and packages, with explicit findings and coverage reporting.

A fence keeps things out, but also in. This project is still in early, and active development.

An open database of real-world AI agent incidents.

Open-source cybersecurity analysis agent for Claude Code. Scans projects for vulnerabilities across all OWASP 2025 Top 10 and CWE Top 25 cat

Scan your dev machine for AI agents, MCP servers, IDE extensions, and suspicious packages - in seconds.

A CI/CD Red Team Framework for demonstrating Build Pipeline security risks.

Mini Program Engineering Skill Suite is an Agent Skill suite for evidence‑first mini‑program development. It helps agents bring WeChat or ot

Detect abandoned and end-of-life dependencies that CVE-based scanners don't flag, and rank which ones to remove first.

Security-oriented three-axis observability for sandboxed AI agents: model intent, app context, and runtime telemetry into verifiable evidenc

Open-source retail banking platform: 70+ Kotlin/Quarkus microservices, double-entry ledger, PSD2, ISO 20022, Temporal workflows, governance-

A codebase scanner that helps you not run malicous code

Static security scanner and linter for GitLab CI. Finds .gitlab-ci.yml misconfigurations, supply-chain risks, and leaked secrets. Offline, S

Static security scanner for npm/PyPI packages, MCP servers, agent skills and repos. Runs locally, never runs the code, no LLM. CLI, Claude C

Laravel Security Tool

Cache Commander — a TUI and MCP server to explore, audit, and clean developer cache directories. Scan for CVEs, find outdated packages, recl

Static and dynamic analysis tool for detecting malicious code, suspicious binaries, and privacy violations

Dependency safety gate for Claude Code & Codex CLI — OSV pre-approval, npm lockfile-closure enforcement, and auto-rollback. Local, zero runt

AVE - Agentic Vulnerability Enumeration. The open behavioral classification standard for agentic AI components.

Supply-chain attack scanner for the agent era. Triage in 30s with `npx patient-zero`, block malicious installs before postinstall runs, or d

See the AI keys and agents you can't. A read-only check for your Mac, Windows & Linux from GIRD.

Tool-agnostic Agent Skill for dependency supply-chain defense

The definitive collection of cross-platform Agent Skills. Compatible with Claude Code, Codex, Cursor, OpenClaw, Gemini CLI, Copilot, Hermes.

Safely run untrusted repos (fake-interview malware, infostealers, RATs) in a locked-down, ephemeral container. No host secrets reachable, ne

Harden your package manager configs against supply chain attacks.

Maintainer-governed agent for evidence-backed open-source contribution proposals

Is your lockfile pwned? 5-second scan of npm/PyPI/Maven/Cargo/Go/RubyGems lockfiles for compromised packages — OSV + curated campaign feed,

Find the plaintext secrets on your Mac and move them behind Touch ID, injected just in time without breaking the tools that read them. Free

🦞 Local, read-only security audit for your OpenClaw agent. Finds config, prompt-injection and supply-chain risks, watches for drift, and ve

Hands-off supply-chain watchdog for dev machines: orchestrates multiple security scanners (Perplexity bumblebee + osv-scanner, govulncheck,

Tamper-evident evidence and verification layer for AI agents. Verify any agent's session offline with just openssl. No cloud, no lock-in.

AI security agent for the Python supply chain: scans packages, generates exploits, and validates them in Docker, autonomously.

A Git-native dependency admission controller. Evaluates trust signals on every dependency change and blocks commits or builds when packages

Vulnerability scanning with your own scanners and threat feeds, plus a coding agent that opens the fix PR. CLI, GitHub Action, or scheduled

Security-first, self-hosted AI agents - isolation you can prove, not just promise.

OMCBench is a benchmark suite for evaluating malicious-code detection capabilities. The benchmark consists of a labeled set of 800 Python an

Tiny offline Codex auth.json snapshot switcher for multiple ChatGPT accounts. Zero dependencies, no network.

Guardrails para desenvolver com agentes de IA: gate de CI bloqueante, hooks determinísticos, supply chain travada e fluxo de task com evidên

Deterministic security analysis for agent skill files.