Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+21 moreClaude CodeCursorCodex CLIMuseDots
Manus
Grok
Grok Bot+18 agentsAI Agent Security Auditor
Expert security review for AI agents to identify prompt injection, data leakage, and unsafe tool permissions.
$15.99
AI Agent Security Auditor
Example session with this skill installed
Review my agent architecture. It is a support bot that uses a SQL tool to look up orders and a Mailgun tool to send updates. It has a system prompt and uses RAG on customer tickets.
- Read your context and instructions
- Compiled the ai agent security
I have reviewed the support agent architecture. The analysis identifies critical risks regarding SQL tool scoping and indirect prompt injection through the RAG pipeline.
Agent Security Audit Report
Executive Security Summary
The agent lacks a trust boundary between untrusted RAG content and the SQL tool execution. A high-risk path exists where a malicious ticket could trigger unauthorized database queries.
Findings Register
| Finding ID | Component | Risk | Severity | Mitigation |
|---|---|---|---|---|
| SEC-01 | SQL Tool | Excessive Permission: Tool can likely execute DELETE or DROP. | Critical | Implement a read-only DB user for the agent. |
| SEC-02 | RAG Flow | Indirect Prompt Injection via customer tickets. | High | Use a separate LLM pass to sanitize retrieved content. |
| SEC-03 | Mailgun | PII Leakage: Agent might send full DB rows to external API. | Medium | Implement output filtering to redact sensitive fields. |
Unsafe Action Analysis
The sql_lookup tool currently lacks argument validation. A user or a malicious ticket could manipulate the order_id parameter to perform a UNION SELECT attack, potentially exposing the entire customers table. The send_email tool requires a human-in-the-loop approval gate for any destination address not previously verified in the order record.
Prioritized Remediation Plan
- Immediate: Restrict the SQL tool's database user to
SELECTprivileges on theorderstable only.
Short-term: Add a verification step for the send_email tool to prevent the agent from being used as a spam relay.
3. Short-term: Define a strict JSON schema for all tool inputs to prevent injection into SQL/URL strings.
Next steps
- Provide the specific SQL tool schema to verify input validation logic.
- Confirm if the database connection uses a scoped service account or administrative credentials.
- Implement a human-in-the-loop (HITL) flag for the
send_emailfunction.
Connects securely to your tools. The creator never sees your data.
About this skill
Building AI agents with broad tool access and long-term memory often introduces critical security vulnerabilities. Developers frequently grant agents excessive permissions or fail to account for indirect prompt injection from retrieved data. This skill provides a rigorous security review of your agent architecture to identify these risks before they reach production.
What it does
- Permission Review identifies excessive read, write, or execute access and recommends least-privilege configurations.
- Threat Modeling traces how untrusted inputs from users or external sources influence tool calls and decision logic.
- Injection Analysis assesses exposure to hostile instructions within prompts, RAG documents, and third-party messages.
- Leakage Detection flags potential secret exposure in logs, traces, and agent outputs to external tools.
- Action Auditing evaluates the safety of destructive operations, bulk actions, and cross-tenant data movement.
How it works
- Context Intake where you provide agent instructions, tool schemas, and data flow diagrams.
- Asset Mapping to define trust boundaries and identify sensitive credentials or data stores.
- Finding Generation where the skill produces a categorized register of vulnerabilities with severity and confidence ratings.
- Remediation Planning to deliver a prioritized list of mitigations, such as approval gates and scoped credentials.
Frameworks & tools
This skill is platform-agnostic and works with OpenAI Assistants, LangChain, AutoGPT, CrewAI, and custom MCP server implementations.
Why this beats prompting it yourself
Generic security prompts often miss indirect injection paths or fail to map trust boundaries between sub-agents. This skill uses a structured engineering workflow to ensure every tool call and data destination is audited against least-privilege principles, not just surface-level prompt safety.
Use cases
- Auditing a customer support agent that has access to production database tools.
- Reviewing a RAG system for prompt injection risks from untrusted external documents.
- Evaluating multi-agent workflows for cross-tenant data leakage risks.
- Validating the safety of agents capable of executing code or shell commands.
Known limitations
This is a document-based architecture review. It does not perform active penetration testing or live exploit execution. Missing evidence in supplied docs will be flagged as unknown rather than safe.
Requires documentation of tools, permissions, and data flows. Does not perform live penetration testing or exploit execution. Analysis is limited to provided evidence.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before any payment.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scan
Security scan passed 28 days ago
Permissions
No special permissions declared or detected