Agent Security Scan

The response model uses this skill for a report-only static review of host settings, hooks, skill text and Model Context Protocol configuration. The default scanner reads local files and reports exposed credentials, remote fetches and instructions, shell side effects, package-manager use and broad execution or protocol exposure. External security runtimes are optional.

Scope and trigger

Apply the scan after relevant hooks, skills, server configuration or credential files change, after governance rules from another project are adopted, or when the user asks to inspect suspicious commands. The response model selects the authorized repository and home targets before running the scanner; the table below does not expand the user's scope.

Procedure

1. The response model establishes the repository root and home candidates from authorized context.
2. When both the repository and home candidate sets are authorized, it invokes python3 <loaded-skill-directory>/scripts/scan_agent_security_surface.py --root <absolute-repo> --home <absolute-home> --json through the host's shell tool. The bundled command scans both sets and has no path allowlist. For a narrower request, read only the named allowed files through the host's file tools and report that limited coverage; do not broaden the request or invent an empty home path to imitate a scope flag.
3. It reads the exit status and the returned JSON root, home, finding_count and findings, then each finding's severity, rule and mitigation. The scanner lists skills under the root by matching immediate */SKILL.md; do not claim from that command that it covers skills nested in a family folder. When an observation is unavailable, that coverage stays unresolved.
4. It reports mitigation=reject, critical and high findings as blockers requiring a separately authorized fix workflow. Scanner output alone does not authorize deletion, edits or disabling servers.

Output

{
  "findings": [{
    "severity": "high - command can run without protective gate",
    "rule": "unprofiled-shell-command",
    "path": "/path/settings.json",
    "message": "hook command executes through shell without Ghost-ALICE profile gate",
    "mitigation": "mitigate"
  }]
}

The scanner's severity values are:

• critical - credential exposure or secret access
• high - command can run without protective gate
• high - write, install, permission, or destructive side effect
• medium - package manager or broad MCP exposure
• medium - remote instruction surface
• low - unclear provenance or ownership
• low - hygiene or configuration issue

Warnings

The response model reports paths, rules and redacted messages, never raw secrets. The default scan makes no network call and applies no automatic fix. This skill inspects settings, hooks and skill text that can run commands; adversarial-verification separately evaluates claims and evidence.