bruc3van/agent-skills-guard

一款提供Agent Skills安全扫描和可视化管理的桌面应用 | A desktop application that provides security scanning and visual management for Agent Skills.

What it solves

Agent Skills Guard addresses the security and management challenges associated with installing community-created "skills" (plugins/tools) for AI coding agents like Claude Code. It eliminates the need for manual code review and fragmented command-line management by providing a centralized, visual interface for discovering, scanning, and managing these extensions.

How it works

The project operates as a desktop application (built with Tauri, React, and TypeScript) that acts as a secure "app store" for AI agent skills. It employs a multi-layer scanning pipeline to analyze skills before installation, checking for risks such as remote code execution, command injection, and sensitive data leaks. It also manages the lifecycle of these skills—from discovery in curated repositories to installation and synchronization across different AI tools (e.g., Claude Code, Codex, Antigravity).

Who it’s for

Developers and users of AI coding agents (specifically Claude Code and similar tools) who want to expand their agent's capabilities with community skills but are concerned about the security risks of executing untrusted code on their local machines.

Highlights

  • Multi-Layer Security Scanning: Detects 8+ risk categories, including Unicode spoofing, multi-step attack chains, and file type masquerading.
  • Hard-Trigger Protection: Automatically blocks the installation of skills that trigger critical "red line" rules (e.g., rm -rf / or SSH key injection).
  • Visual Skill Management: Provides a macOS-style GUI for one-click installation, updates, and uninstallation of skills and plugins.
  • Curated Market: Includes a built-in market of human-vetted skills and supports adding custom GitHub repositories.
  • CLI Tool Integration: Automatically discovers and manages local command-line tools installed via npm, pip, Homebrew, and other package managers.

Related

  • Project
    aiskillstore/marketplace

    An open-source marketplace repository for AI agent skills, providing a secure distribution system and CLI for adding capabilities to tools like Claude Code and Codex.

  • Project
    cisco-ai-defense/skill-scanner

    Skill Scanner is an open‑source security scanner for AI‑agent skill packages (e.g., OpenAI Codex, Cursor, Claude). It combines signature‑based YARA/YAML rules, AST‑based data‑flow analysis, optional LLM‑as‑a‑judge, and a CEL decision layer to detect prompt‑injection, data‑exfiltration, and malicious code patterns. Install via pip, run from the CLI or Python SDK, and integrate with CI/CD via GitHub Actions or a pre‑commit hook. Findings are reported with severity levels; a clean scan is best‑effort only and does not guarantee safety.

  • Project
    michaelshimeles/skills

    A curated set of Claude Code agent skills that automate common development tasks—visual diff generation, service‑layer structuring, evidence‑driven UI testing, iterative Greptile review loops, work‑tree isolation, and prose clean‑up—plus a ready‑to‑drop workflow tying them together.

  • Project
    affaan-m/agentshield

    A security auditor for AI agent configurations that scans Claude Code setups for secrets, permission misconfigurations, and prompt injection vectors.

  • Project
    tiangolo/library-skills

    A tool that installs and manages official AI skills provided by libraries, ensuring AI agents use the most current and correct code patterns instead of outdated training data.