GoPlusSecurity/agentguard

What it solves

AI agents often have broad access to a user's terminal, files, and secrets, but lack inherent security awareness. This makes them vulnerable to malicious skills, prompt injections, and unverified code that could steal credentials, exfiltrate data, or execute destructive commands (like rm -rf /).

How it works

AgentGuard implements a multi-layered security approach:

• Automatic Guard (Hooks): A real-time layer that blocks destructive commands, prevents unauthorized writes to sensitive files (e.g., .env, .ssh/), and detects data exfiltration to common webhooks.
• Deep Scan: An on-demand static analysis tool with 24 detection rules that scans new skills for backdoors, obfuscation, and Web3-specific exploits (like wallet draining) before they are executed.
• Daily Patrol: A scheduled security assessment that runs eight comprehensive checks, including skill integrity, secrets exposure, network exposure, and audit log analysis.
• Integration: It integrates as a plugin or hook for various agents including Claude Code, OpenClaw, Hermes, Codex, and DeepSeek Harness (DSH).

Who it’s for

Users of AI coding agents and autonomous agents who want to protect their local environment and sensitive data from malicious plugins or prompt-driven attacks.

Highlights

• Real-time Blocking: Stops dangerous shell commands and unauthorized file access instantly.
• Skill Auditing: Scans GitHub repositories or local directories for malicious code before installation.
• Web3 Security: Specialized detection for wallet draining and proxy exploits.
• Threat Intelligence: Optional subscription to a threat-intelligence feed for newly published advisories.
• Broad Compatibility: Supports multiple agent frameworks and provides native bundles for DSH.