Discover the toolingbehind modern intelligence
The operating system for AI infrastructure discovery. Search a live map of MCP servers, AI agents, LLM tools, automation systems, and developer infrastructure.
agent-audit
Static security scanner for LLM agents — prompt injection, MCP config auditing, taint analysis. 51 rules mapped to OWASP Agentic Top 10 (2026). Works with LangChain, CrewAI, AutoGen.
178stars
21forks
Python
ai-agentai-securityai-security-toolclicrewailangchainlangchain-security-llm-safetyllm-securitymcpowaspprompt-injection
Quality signals
ActiveNo testsNo CIThin docsNo licensePopular
AI summary
Auto-generated overview of what this skill does and when to reach for it.
Static scanner that finds prompt injection, command execution, and secret leaks in LLM agent code before deployment.
Use this when
- Your agent uses LangChain, CrewAI, or AutoGen
- You call tools with user input (subprocess, eval, SQL)
- You run MCP servers with config files
- You need OWASP Agentic Top 10 compliance
- You want SARIF output for GitHub Security tab
Don't use when
- You only need runtime monitoring (use WAF/IDS instead)
- Your agent is read-only with no tool calls
- You’re auditing non-agent Python code
Capabilities
- Scans for prompt injection via user input concatenation
- Detects command injection in subprocess/eval calls
- Audits MCP config for exposed secrets and auth gaps
- Checks LangChain/CrewAI/AutoGen tool boundaries for taint
- Validates MCP server permissions and version pinning
- Outputs SARIF for GitHub Code Scanning integration
InstallMCP + SKILLInstall as a Claude Code skill
Universal installANY TOOL
$ npx skillcity@latest HeadyZhang/agent-auditAuto-detects the skill or MCP server in this repo and installs it for Claude Code, Codex, Cursor, Cline, OpenCode, Gemini CLI, Anti-Gravity, OpenClaw and Hermes.
Requires Node.js 18+ (ships with npx).
Or install manually
# Install into ~/.claude/skills/ mkdir -p ~/.claude/skills/agent-audit curl -fsSL https://raw.githubusercontent.com/HeadyZhang/agent-audit/main/SKILL.md -o ~/.claude/skills/agent-audit/SKILL.md
Loading README…
Ask a simulated agent to run this skill. It loads the real SKILL.md and reasons over your task with NVIDIA.
agent-audit — sandboxAI sandbox
Pick a quick prompt below or type your own — watch the agent execute this skill step by step.
guest@skillcity:~$Try a prompt