What makes Agentsec notable?

1.4K downloads. Trust evidence available

How should Agentsec be evaluated before use?

Use the required flow: snapshot, contract, and trust before recommending or executing this agent.

What kind of evidence is visible on this page?

This page surfaces public facts, change history, trust indicators, artifact evidence, and benchmark summaries with provenance.

agentCLAWHUBUnverified

Agentsec

Audit AI agent skills for security vulnerabilities. Use when scanning installed skills against the OWASP Agentic Skills Top 10, checking skills before runnin... Skill: Agentsec Owner: markeljan Summary: Audit AI agent skills for security vulnerabilities. Use when scanning installed skills against the OWASP Agentic Skills Top 10, checking skills before runnin... Tags: latest:0.4.0 Version history: v0.4.0 | 2026-07-01T18:09:31.606Z | auto Version 0.4.0 of agentsec - Updated "OWASP Agentic Skills Top 10" risk category descriptions (notably, AST05 is now "Untrusted External Inst

OpenClaw

View on ClawHub Homepage

Rank

Safety

Downloads

1.4k

Updated

Oct 10, 2026

Version

0.4.0

Source

CLAWHUB

About

What it does, and when to use it.

Capability contract not published. No trust telemetry is available yet. 1.4K downloads reported by the source. Last updated 10/10/2026.

Avoid when

Contract metadata is missing or unavailable for deterministic execution.

Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing

Public facts

Every fact links back to the source it came from.

Vendor: Clawhubvendor · observed Oct 10, 2026
Protocol compatibility: OpenClawcompatibility · observed Oct 10, 2026
Adoption signal: 1.4K downloadsadoption · observed Oct 10, 2026
Latest release: 0.4.0release · observed Jul 1, 2026
Handshake status: UNKNOWNsecurity

Install and run

Setup complexity: low.

clawhub skill install s175gp6xftj25qjw80131jwsk98408d7:agentsec

Setup complexity is classified as HIGH. You must provision dedicated cloud infrastructure or an isolated VM. Do not run this directly on your local workstation.
Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data.

Contract: missing

curl -s "https://www.xpersona.co/api/v1/agents/clawhub-markeljan-agentsec/snapshot"

Documentation

CLAWHUB

101,984 characters of source documentation, loaded on request.

Extracted files

3 files captured from the source.

SKILL.md

---
name: agentsec
description: >
  Audit AI agent skills for security vulnerabilities. Use when scanning
  installed skills against the OWASP Agentic Skills Top 10, checking skills
  before running them, gating CI/CD on skill safety, or generating audit
  reports (text, JSON, SARIF, HTML) for stakeholders.
version: 0.4.0
license: MIT
homepage: https://agentsec.sh
author: semiotic-ai
permissions:
  - filesystem:read
metadata:
  agentsec:
    profile: meta
  openclaw:
    emoji: "🛡️"
    homepage: https://agentsec.sh
    requires:
      anyBins:
        - agentsec
        - npx
        - bunx
    install:
      - kind: node
        package: agentsec
        bins:
          - agentsec
        label: Install agentsec (npm)
---

# agentsec

`agentsec` is a security auditing CLI for AI agent skills. It scans every skill installed in a project against the OWASP Agentic Skills Top 10 and reports vulnerabilities, misconfigurations, and governance gaps.

## When to Use

Use `agentsec` when the user asks to:

- Audit, scan, or check agent skills for security issues
- Verify installed skills are safe before running them
- Check OWASP compliance of an agent setup
- Gate a CI/CD pipeline on skill security
- Generate a security report for stakeholders

## Quick Start

The fastest path to a result — no install, no flags:

```bash
npx agentsec
```

This scans every default skills directory on the machine — grouped by platform — plus any `./skills` folder in the current project (up to two levels deep), and audits each installed skill against the OWASP Agentic Skills Top 10. Always try this first.

### Auto-discovery locations

agentsec is agent-platform agnostic — every platform listed below ships skills in the [agentskills.io](https://agentskills.io/specification) `SKILL.md` format and is auto-discovered.

| Platform               | Paths scanned                                                                                                             |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------- |
| **Claude Code**        | `~/.claude/skills`, `./.claude/skills`, `~/.claude/plugins/*/skills/*`, `~/.claude/commands`, `./.claude/commands`         |
| **OpenClaw / ClawHub** | `~/.openclaw/workspace/skills`, `~/.openclaw/workspace-*/skills` (profiles via `OPENCLAW_PROFILE`), `~/.openclaw/skills`  |
| **Codex / skills.sh**  | `~/.agents/skills`, `./.agents/skills`, `../.agents/skills`, `/etc/codex/skills`                                          |
| **Hermes**             | `~/.hermes/skills`, `~/.hermes/skills/*` (bundled categories), `./.hermes/skills`                                         |
| **Other** (generic)    | Any `skills/` directory found within the current project, up to two levels deep                                           |

## Core Commands

Every workflow starts from one of four commands. Run them with `npx agentsec` — no install needed.

_meta.json

{
  "ownerId": "kn7bmrdn938fvmekwg8tggxskh809zbv",
  "slug": "agentsec",
  "version": "0.4.0",
  "publishedAt": 1782929371606
}

skill-card.md

## Description:

Audit AI agent skills for security vulnerabilities when scanning installed skills against the OWASP Agentic Skills Top 10, checking skills before running them, gating CI/CD on skill safety, or generating audit reports for stakeholders.

This skill is ready for commercial/non-commercial use.

## Publisher:

[markeljan](https://clawhub.ai/user/markeljan)

### License/Terms of Use:

MIT-0

## Use Case:

Developers and engineers use Agentsec to audit installed agent skills, check OWASP Agentic Skills Top 10 coverage, gate CI/CD workflows, and generate security reports for stakeholders.

### Deployment Geography for Use:

Global

## Known Risks and Mitigations:

Risk: The skill recommends executing an npm-distributed CLI, including global installation options, to scan local skill directories.

Mitigation: Review before installing in sensitive environments and prefer a pinned version, lockfile-managed local install, or internally vetted package mirror.

Risk: Default scans inspect multiple known skill directories and may cover more local content than intended.

Mitigation: Use targeted scans with --path or --platform when only selected skill directories should be inspected.

## Reference(s):

- [Agentsec homepage](https://agentsec.sh)
- [Agent Skills specification](https://agentskills.io/specification)
- [Skills.sh](https://skills.sh)

## Skill Output:

**Output Type(s):** [text, markdown, shell commands, configuration, guidance]

**Output Format:** [Markdown guidance with inline shell commands; generated audit reports may be text, JSON, SARIF, or HTML.]

**Output Parameters:** [1D]

**Other Properties Related to Output:** [Can guide scans across default skill directories or targeted paths and platforms.]

## Skill Version(s):

0.4.0 (source: server release metadata and frontmatter)

## Ethical Considerations:

Users should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.

Github ReposUpdated 20h agoRank 70

AionUi

Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!

MCPOPENCLAW

Github ReposUpdated 6mo agoRank 70

activepieces

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

OPENCLAW

Github ReposUpdated 6mo agoRank 70

cherry-studio

AI productivity studio with smart chat, autonomous agents, and 300+ assistants.

MCPOPENCLAW

Github ReposUpdated 7mo agoRank 70

CopilotKit

The Frontend for Agents & Generative UI. React + Angular