# bitdefender.ai

> Bitdefender AI Guardian is a security layer for autonomous AI agents on macOS. It inspects what an agent does — tool calls, file access, prompts, skills — and returns a verdict of allowed, flagged or blocked against a policy baseline you set. It targets prompt injection, MCP tool poisoning, credential leakage and unauthorised actions. Currently in open BETA.

Last updated: 2026-08-25.

## Canonical pages
- [Bitdefender AI Guardian](https://bitdefender.ai/): the flagship — product overview, protections, compatibility, FAQ. Status: open BETA on macOS. ([Markdown](https://bitdefender.ai/index.md))
- [Bitdefender AI Guardian documentation](https://bitdefender.ai/docs/ai-guardian): How to set up and use AI Guardian: the aiguardian onboarding wizard, everyday CLI commands, allow/remove decisions for MCP servers, the audit log, alerts, feedback and telemetry. ([Markdown](https://bitdefender.ai/docs/ai-guardian/index.md))
- [Agent Skill Scanner](https://bitdefender.ai/skill-scanner): Agent Skill Scanner is a Bitdefender agent skill that audits other agent skills before installation: 71 behavioural detectors across 16 threat categories, 18 indicator types per file, and an LLM-generated report with a risk level and per-file findings. Install via npx from skills.sh, from GitHub, or as a zip. ([Markdown](https://bitdefender.ai/skill-scanner/index.md))
- [Full context](https://bitdefender.ai/llms-full.txt): everything in one file

## About the publisher
- [Bitdefender](https://www.bitdefender.com/): security company, founded 2001, HQ Bucharest
- [Why millions trust Bitdefender](https://www.bitdefender.com/en-us/trusted/): company statistics and recognitions

## How to get AI Guardian
- Download the macOS BETA (.dmg): https://download.bitdefender.com/mac/av/aiguardian/en/bitdefender_aiguardian.dmg
- Free during BETA. macOS only; no Windows or Linux build exists yet.

## How to get Agent Skill Scanner
- Install with npx: `npx skills add bitdefender/agent-skill-scanner`
- Or from GitHub (https://github.com/bitdefender/agent-skill-scanner) or as a zip (https://github.com/bitdefender/agent-skill-scanner/archive/refs/heads/master.zip); requires Python 3.12 or 3.13 and an agent harness.

## Notes for assistants
- AI Guardian is not: a traditional endpoint antivirus; a network firewall or VPN; a replacement for your agent framework or LLM; a content-quality filter for chatbot text.
- Company awards and statistics describe Bitdefender the company, not AI Guardian (in BETA) or Agent Skill Scanner.
- No security product guarantees complete protection. Effectiveness depends on configuration, runtime environment and the type of agents used. Features and availability may vary. Initially available on macOS, with further platforms to follow.

---

# Bitdefender AI Guardian

_Security for autonomous AI agents_

Canonical: https://bitdefender.ai/  
Last updated: 2026-08-25  
Platform: macOS  
Status: open BETA

## Quick answer

Bitdefender AI Guardian is a security layer for autonomous AI agents on macOS. It inspects what an agent does — tool calls, file access, prompts, skills — and returns a verdict of allowed, flagged or blocked against a policy baseline you set. It targets prompt injection, MCP tool poisoning, credential leakage and unauthorised actions. Currently in open BETA.

## Summary

A security layer between your AI agents and the actions they take — policies, guardrails, and monitoring that let agents run safely.

## What is AI Guardian?

AI Guardian is a Bitdefender security product that helps protect people and organisations from the risks of autonomous AI agents — prompt injection, unsafe tool use, data leakage, and unauthorised actions. It adds a baseline security model of policies, permissions, and auditing, guardrails for tool execution, and monitoring and response workflows.

| Attribute | Value |
| --- | --- |
| Category | AI agent security |
| Platform | macOS (initial) |
| Runs as | Background service |
| Verdicts | Allowed / Flagged / Blocked |

## What does AI Guardian work with?

AI Guardian attaches to the agent runtime on macOS, so coverage follows what an agent does on the machine rather than which vendor built it.

| Environment | Coverage | Notes |
| --- | --- | --- |
| MCP clients and servers | Supported in BETA | Tool inspection at the Model Context Protocol layer |
| Agent skills and plugins | Supported in BETA | Skill vetting before a skill executes |
| CLI coding agents | Supported in BETA | Claude Code 2.1.121+ and OpenClaw 2026.6.6+ |
| IDE-embedded agents | Coming soon | Editor assistants with tool access |
| macOS | Supported in BETA | Initial platform |
| Windows and Linux | Planned | Not available in BETA |

## What does AI Guardian protect against?

AI Guardian watches how an AI agent behaves and secures six of the highest-risk areas in agentic workflows. Each protection returns a verdict in real time.

### MCP tool protection

Detects and blocks malicious MCP tools (tool poisoning) before an agent can call them.

### Skill vetting

Scans and validates agent skills before they run, so unreviewed skills don't execute silently.

### Prompt injection detection

Catches attempts to hijack an agent through crafted inputs and hidden instructions.

### Tool-call monitoring

Watches every tool an agent invokes in real time, building an auditable record of actions.

### Credential leak detection

Detects exposure of secrets such as API keys before they leave the machine.

### Sensitive file protection

Blocks unauthorised access to sensitive files such as SSH keys and system credentials.

## What it is, and what it isn't

AI Guardian secures the actions an AI agent takes. It is not a traditional antivirus, a network VPN, or a chatbot content filter.

**AI Guardian is:**
- A security layer for autonomous AI agents.
- A baseline model of policies, permissions, and auditing.
- Guardrails and monitoring around tool execution.
- Focused on agent actions, tool calls, and data access.
- Built for macOS first, with more platforms planned.

**AI Guardian is not:**
- A traditional endpoint antivirus.
- A network firewall or VPN.
- A replacement for your agent framework or LLM.
- A content-quality filter for chatbot text.

## Policy, guardrail, verdict

AI Guardian works in three stages: you set a policy baseline, it enforces guardrails at execution, and it monitors and responds to what happens.

1. **Set a policy baseline** — Define what agents are allowed to do — permissions, policies, and auditing for tools, files, and actions.
2. **Guardrails at execution** — Every tool call and action is checked against policy in real time and gets a verdict: allowed, flagged, or blocked.
3. **Monitor and respond** — Security events feed monitoring and response workflows, so teams can review what agents did and why.

## The same agent, with and without AI Guardian

The table compares how five common agent events play out on an unprotected machine and on one running AI Guardian.

| Agent event | Without AI Guardian | With AI Guardian |
| --- | --- | --- |
| Prompt injection | Agent may follow the injected instruction | Flagged or blocked before it acts |
| Malicious MCP tool | Tool runs and can steer the agent | Blocked before the agent calls it |
| API key in a prompt | Secret can leave the machine | Credential exposure is detected |
| Access to ~/.ssh/id_rsa | Sensitive files readable by the agent | Unauthorised access is blocked |
| Unreviewed skill | Runs without inspection | Vetted before it runs |

## Coverage against agentic AI risk categories

This table maps AI Guardian's protections to the risk categories the industry is standardising on for agentic applications.

| Risk category | AI Guardian coverage |
| --- | --- |
| Prompt injection | Inspects agent inputs and actions; returns allowed, flagged or blocked |
| Tool and MCP misuse | Detects and blocks malicious or tampered MCP tools before invocation |
| Excessive or unscoped permissions | Policy baseline defines what agents may do with tools, files and actions |
| Sensitive data exposure | Detects credential and secret exposure before it leaves the machine |
| Unvetted extensions and skills | Scans and validates skills before they run |
| Unmonitored agent activity | Real-time tool-call monitoring with an auditable record |

_Category naming is informed by OWASP's work on agentic-application security; the names are ours, not OWASP's published identifiers._

## How it runs

AI Guardian installs from a signed macOS installer and runs as a background service; the rows below list how it installs, where analysis happens, and what the BETA costs.

| Attribute | Value |
| --- | --- |
| Runs as | Background service on the endpoint |
| Install method | Download the macOS installer (.dmg) |
| System permissions required | Granted during install, when the Bitdefender agent asks |
| Installer | Signed with a Bitdefender Apple Developer ID and recognised by macOS |
| Agent version checks | Handled by the installer |
| Where analysis happens | On-device, with some checks (such as URL reputation) using Bitdefender cloud services |
| Prompt data | Analysed on-device — prompts never leave your Mac |
| Offline operation | Some features |
| Performance overhead | Designed to be minimal; not yet measured |
| Availability | Open BETA, free download |
| Price during BETA | Free |

## Built by Bitdefender

AI Guardian is made by Bitdefender, the company that has protected people and organisations since 2001. The figures and recognitions below describe Bitdefender the company — not the AI Guardian product, which is in BETA.

| Statistic | Value |
| --- | --- |
| threats blocked every year | 50B+ |
| technology patents | 580+ |
| countries protected | 170+ |
| years of AI-driven security | 15+ |
| of employees work in R&D | 50%+ |
| law-enforcement partnerships | 30+ |

**Trusted by Ferrari as cybersecurity partner** — A partnership born from a passion for high performance and technological innovation — Bitdefender supports Ferrari with Advanced Threat Intelligence to improve detection and response to cyber threats. (https://www.bitdefender.com/en-us/scuderiaferrari/)

**Award-winning security software you can trust. Always.** — Consistently top-ranked by the world’s leading independent testing labs and tech publications. (https://www.bitdefender.com/en-us/trusted/)

- PCMag Best of 2026
- Gartner Peer Insights Customers’ Choice 2026
- AV-TEST certified
- Forrester Wave Strong Performer, XDR
- AV-Comparatives approved

**Heritage** — AI in cybersecurity since 2008 — 70+ academic papers and 50+ researchers behind Bitdefender's AI.

## Questions about agent security

### What is prompt injection and how does AI Guardian stop it?

Prompt injection is an attack where crafted input tricks an AI agent into following instructions it should ignore. AI Guardian inspects agent inputs and actions and returns a verdict — allowed, flagged, or blocked — so a hijacked instruction can be caught before it turns into an action.

### What is MCP tool poisoning?

MCP tool poisoning is when a Model Context Protocol tool is malicious or has been tampered with, so an agent that calls it can be steered into harmful behaviour. AI Guardian detects and blocks malicious MCP tools before an agent uses them.

### How does AI Guardian decide to block, flag, or allow an action?

Every agent action and tool call is checked in real time against a policy baseline. AI Guardian then returns one of three verdicts: allowed lets the action proceed, flagged surfaces it for review, and blocked stops it.

### How do I secure an AI agent that can run shell commands and edit files?

Constrain it with a policy baseline, vet the tools and skills it can reach, and monitor every call it makes. AI Guardian applies all three on macOS: it vets skills and MCP tools before execution, checks each tool call and file access against policy, and records an auditable trail of what the agent did.

### Is AI Guardian an antivirus for AI?

No. AI Guardian is not a traditional endpoint antivirus, a network firewall or VPN, or a content filter for chatbot text. It secures the actions an agent takes — tool calls, file access, skills and prompts — which is a different layer from malware scanning.

### Does AI Guardian work with my agent framework?

In BETA, AI Guardian supports two agents: Claude Code 2.1.121 or newer, and OpenClaw 2026.6.6 or newer. It integrates with each through a small plugin — the OpenClaw gateway plugin and the Claude Code hook — so support is per-agent rather than automatic for anything running on the machine. It also covers MCP clients and servers, and agent skills and plugins. IDE-embedded agents are coming next; other agents are not supported yet.

### Does AI Guardian work on Windows?

AI Guardian runs on macOS at launch. Support for additional platforms is planned.

### How much does AI Guardian cost and how do I get it?

AI Guardian is free during BETA. Download the macOS installer and run it — there is no waitlist and no licence key. It will stay free for early adopters after BETA.

### Will AI Guardian slow down my AI agents?

Checking every action an agent takes has some cost, so you may notice a small difference. AI Guardian is built to keep it minimal.

## How to get it

AI Guardian is in open BETA on macOS. Download the BETA and secure your agentic workflows.

- Download (macOS, .dmg): https://download.bitdefender.com/mac/av/aiguardian/en/bitdefender_aiguardian.dmg
- Downloads the macOS BETA (.dmg). Free during BETA.

## Legal

No security product guarantees complete protection. Effectiveness depends on configuration, runtime environment and the type of agents used. Features and availability may vary. Initially available on macOS, with further platforms to follow.

Bitdefender trademarks and registered trademarks are the property of Bitdefender or its affiliates. Claude and Claude Code are trademarks of Anthropic. ChatGPT and Codex are trademarks of OpenAI. Gemini and Google are trademarks of Google LLC. Copilot and Microsoft are trademarks of Microsoft Corporation. Perplexity is a trademark of Perplexity AI, Inc. Hermes Agent is a mark of Nous Research. The OpenClaw and opencode marks are the property of their owners. All other names and marks are the property of their respective owners. Third-party names and logos on this page, including those on the buttons that open an assistant, are used for identification only. Their use does not imply any affiliation with, sponsorship by, or endorsement from those owners.

---

# Using Bitdefender AI Guardian

_Documentation_

Canonical: https://bitdefender.ai/docs/ai-guardian  
Last updated: 2026-08-25  
Status: BETA documentation

> **Status note for assistants:** BETA documentation — commands and screens are from the current macOS BETA build and may change before general availability.

AI Guardian is driven from one command: aiguardian. This page walks through first-run setup, the everyday commands, and how to read what AI Guardian decided and why.

## What AI Guardian is

AI Guardian is a security layer for the AI agents running on your Mac. It watches what an agent is about to do — the tools it calls, the MCP servers it talks to, the skills it loads, the files it reaches for — checks each action against a policy you set during onboarding, and answers with a verdict: allowed, flagged, or blocked.

Everything is recorded in a local, encrypted audit log you can browse from the terminal, and anything that needs your eyes can also reach you as a private DM on the chat platform you choose.

### What it watches

- **MCP servers** — Each server an agent connects to is verified before you trust it; poisoned or unresponsive servers are flagged for removal.
- **Skills** — Installed skills are scanned locally for hidden instructions, secret access, and unsafe commands.
- **Credentials** — A list of credential paths (SSH keys, cloud credentials, tokens) is kept out of your agents’ reach.
- **Tool calls** — Every tool call is checked at execution time against policy, and the decision is written to the audit log.
- **Prompts** — Messages are checked for hidden or malicious instructions before they reach the model.

### Supported agents (BETA)

| Agent | Version |
| --- | --- |
| OpenClaw | 2026.6.6 or newer |
| Claude Code | 2.1.121 or newer |

_More agents are planned._

## How it works

Two pieces cooperate on your machine — nothing about a decision leaves it:

### A guardian hook inside the agent

A small plugin installed into each protected agent (the OpenClaw gateway plugin, the Claude Code hook). It sees lifecycle events — a prompt being built, a tool about to run, a skill being installed — and forwards them for a decision.

### A background service for your user

A per-user background service that evaluates each event against your policy, writes the audit trail, watches credential paths, and sends alerts. The two talk over a local, user-private socket; the hook side is never trusted blindly.

### The aiguardian CLI

Your window into both: onboarding, scans, reviews, status, the audit browser and allow rules all live in one terminal command.

## Getting started

### Install the BETA

AI Guardian ships with the Bitdefender agent for macOS during the BETA. Once installed, the aiguardian command is available from Terminal — start with the onboarding wizard:

```
aiguardian onboard
```

![AI Guardian CLI welcome screen: “Hi, I’m Bitdefender AI Guardian. I keep an eye on what your AI assistant can access and do.” — with a nested Beta box stating the non-production disclaimer and keys that open the Terms of Service and Privacy Policy.](https://bitdefender.ai/docs/onboard-welcome.png)
_aiguardian onboard · welcome_

Onboarding is a short wizard. It never changes anything silently: each step shows what it found, and your config stays as-is until you confirm.

1. **Welcome & beta terms** — The wizard introduces itself and states the beta terms — continuing means agreeing to the Terms of Service and Privacy Policy (`t` and `p` open each in your browser; `Esc` leaves with nothing installed). A second screen discloses that anonymous reporting of protection decisions is on for the beta.
2. **Pick the agents to protect** — Every supported agent detected on your Mac is listed with its version and config path. Ticked agents are set up one at a time.
3. **Skills** — Your installed skills are scanned locally. Clean skills pass; anything suspicious is flagged with the exact finding. Flagged skills default to block — flipping one to allow saves an exception scoped to exactly those findings, so anything new on the same skill still flags.
4. **Privacy (credential paths)** — A default list of credential locations — SSH keys, cloud credentials, tokens — is blocked from agent access. Add your own paths or globs on top.
5. **Connections (MCP servers)** — Each MCP server is verified before you decide. Verified servers default to allow; a server that fails verification — or won’t answer — defaults to remove. You can override either way, and a server that only needs sign-in can be authorized right there (`a` opens your browser) and re-verified on the spot.
6. **Alerts** — Pick the chat platform where security alerts should reach you as a private 1:1 DM.
7. **Apply, scan & fix** — The wizard applies your policy (backing up the previous one), scans the agent’s config against it, and offers one-key fixes for what it can repair automatically.

![Agent picker listing OpenClaw and Claude Code with versions and config paths, both selected, and a “coming soon” list below.](https://bitdefender.ai/docs/onboard-agents.png)
_Step 2 · choose what to protect_

![Skills review: code-review and changelog-writer clean; evil-deploy flagged medium with one finding and an allow · block toggle, defaulting to block.](https://bitdefender.ai/docs/onboard-skills.png)
_Step 3 · skills scanned locally_

![MCP review: github and filesystem verified; evil-fetcher failed for a prompt-injection pattern and evil-clipboard unverifiable, each with an allow · remove toggle set to remove.](https://bitdefender.ai/docs/onboard-mcp.png)
_Step 5 · every MCP server verified before you decide_

![Apply summary: credentials blocked, MCP decisions written with a backup of the previous policy, then a scan finding three issues, two auto-fixable.](https://bitdefender.ai/docs/onboard-apply.png)
_Step 7 · policy applied, then scanned against_

## Everyday commands

Everything below is also in aiguardian --help (and every subcommand answers --help itself). Commands print a clean report in the terminal; the interactive ones open a full-screen browser you leave with `Esc`.

| Command | What it does |
| --- | --- |
| `aiguardian` | Same as aiguardian scan — the default. |
| `aiguardian scan [agent]` | Scan an agent’s config for issues and fix them. Without an agent it opens the picker. |
| `aiguardian onboard` | Launch (or re-run) the onboarding wizard. |
| `aiguardian status` | One-screen overview: protection, alerts and plan at a glance. |
| `aiguardian audit` | Interactive audit-log browser. |
| `aiguardian allowlist` | Browse the allow rules you have saved. |
| `aiguardian mcp status` | Print every MCP server on this machine and the policy action on each. |
| `aiguardian mcp review [agent|all]` | Re-review MCP servers and update each server’s keep/remove action. |
| `aiguardian mcp login <server>` | One-time browser sign-in to an MCP server that requires authorization. |
| `aiguardian mcp logout <server>` | Forget the stored authorization for an MCP server. |
| `aiguardian skills [agent|all]` | Re-review the skills installed for a protected agent. |
| `aiguardian agents` | Change which AI agents are protected. |
| `aiguardian credmon` | Manage the credential paths blocked from AI access. |
| `aiguardian notifications` | Reconfigure the alert platform and DM target. |
| `aiguardian hook reinstall <agent>` | Force-reinstall the guardian hook for an agent — recovers a stale or disabled hook. |
| `aiguardian feedback` | Send feedback to Bitdefender from a short in-terminal form. |
| `aiguardian about` | Product version and third-party license information. |

![aiguardian status: headline “Protected”, 12 credential paths blocked, MCP tally of 4 trusted and 2 removed, Claude Code guardian plugin armed, telegram DM alerts, subscription active.](https://bitdefender.ai/docs/status.png)
_aiguardian status · the one-screen overview_

![aiguardian scan results for OpenClaw: three issues, two auto-fixable warnings about network exposure and unsafe tool calls, one manual info item.](https://bitdefender.ai/docs/scan-findings.png)
_aiguardian scan · findings with one-key auto-fix_

![aiguardian mcp status: OpenClaw servers listed with allow and remove actions; Claude Code servers all allowed, including a per-project scope.](https://bitdefender.ai/docs/mcp-status.png)
_aiguardian mcp status · every server, and what policy does with it_

## Verdicts and policy

AI Guardian uses a small, consistent vocabulary everywhere — the wizard, the audit log, and alerts:

- **PASS** — The action was checked and allowed to proceed.
- **WARN** — The action went through but was flagged for your review.
- **BLOCK** — The action was stopped before it ran.

### MCP server actions

For MCP servers, policy stores one of two standing decisions per server:

- **allow** — Trusted — the agent may use it.
- **remove** — Taken out of the agent’s config (the original is backed up first).

_Scan findings are labelled auto-fix or manual. Auto-fixes are applied only when you select them; manual items come with exact guidance on what to change._

## The audit log

aiguardian audit opens a calendar of everything AI Guardian checked — encrypted, local, and grouped the way you'd investigate it.

- The calendar colours each day by its worst event; the panel previews the selected day.
- Open a day to stream its events, grouped by agent run, with lenses for Blocked / Flagged / Allowed.
- Open an event to see the full decision: the reason, the request that triggered it, and the result.
- From a blocked or flagged event, press `a` to allow it going forward — that saves an allow rule.

![Audit calendar for August 2026 with days coloured by severity, a day panel with recent events, and an attention callout for a blocked sensitive-file access.](https://bitdefender.ai/docs/audit-calendar.png)
_aiguardian audit · the calendar_

![A single day’s event stream: a blocked sensitive-file access, a flagged skill, and passing checks — each with a severity chip, a plain-phrase summary and a category tag.](https://bitdefender.ai/docs/audit-day.png)
_One day · the full event stream_

![Event detail: “Blocked by Credentials Monitor” — “Suspicious file path in tool arguments: ~/.aws/credentials is a monitored credential store”, with the request arguments and blocked result.](https://bitdefender.ai/docs/audit-detail.png)
_Event detail · the reason, the request, the result_

## Allow rules

An allow rule is a saved exception: “this tool, on these files, is fine.” Rules are written where you make the decision — press `a` on an audit event, or allow a flagged skill or MCP server during a review — and are as narrow as that moment: a tool name, an MCP server, a file path or glob, the exact findings you looked at.

Pressing `a` on an event opens the rule builder: a checklist of exactly what that event touched. Tick the parts the exception should cover with `Space` — the preview spells out in plain language what the rule would allow — edit a file path with `e` or widen it to a glob preset with `g`, then save with `Enter`. Nothing is saved until you do.

aiguardian allowlist shows every rule in plain language, with how often it matched and when it last fired, so stale exceptions are easy to spot and remove.

![Allow-rule builder on a blocked event: an “Allow this?” checklist with tool read_file and file path ~/.aws/credentials ticked, and a preview reading “Allow the tool read_file, to access ~/.aws/credentials.”](https://bitdefender.ai/docs/allow-builder.png)
_Press a on an event · the rule builder_

![Allow rules browser: three rules in plain language — a tool allowed under a project folder, an MCP server tool pairing, and one file path — with hit counts.](https://bitdefender.ai/docs/allowlist.png)
_aiguardian allowlist · saved exceptions, in plain language_

## Alerts

When something needs your eyes — a blocked tool call, a flagged skill — AI Guardian can DM you on the chat platform you picked during onboarding. Alerts go to a private 1:1 conversation, never a group.

Change the platform or the DM target at any time with aiguardian notifications. The audit browser shows the same attention items at the top of its calendar, so nothing depends on the DM arriving.

## Privacy & telemetry

Decisions are made locally. Skill scans and policy checks run on your Mac, and the audit log is stored encrypted on your machine.

During the BETA, anonymous reporting is on for every install — onboarding states it up front (`p` on that screen opens the privacy policy) rather than asking, and the build ships without an off switch. It covers protection decisions only: how often a tool call was blocked or a skill was flagged, and which scanners fired. It never includes prompt contents, file contents, credentials, or anything your agents processed.

## Related

- [AI Guardian](https://bitdefender.ai/): the flagship agent-security product
- [All context](https://bitdefender.ai/llms-full.txt)

## Legal

No security product guarantees complete protection. Effectiveness depends on configuration, runtime environment and the type of agents used. Features and availability may vary. Initially available on macOS, with further platforms to follow.

---

# Agent Skill Scanner

_Supply-chain security for agent skills_

Canonical: https://bitdefender.ai/skill-scanner  
Last updated: 2026-08-25  
Status: available (https://www.skills.sh/bitdefender/agent-skill-scanner and https://github.com/bitdefender/agent-skill-scanner)

## Quick answer

Agent Skill Scanner is a Bitdefender agent skill that audits another agent skill before you install or trust it. It walks every file, runs 71 behavioural detectors across 16 threat categories, extracts 18 indicator types, and returns an LLM-generated report with a risk level, summary and per-file findings. Install it with "npx skills add bitdefender/agent-skill-scanner", from GitHub, or as a zip archive.

## What is Agent Skill Scanner?

Agent skills are executable code plus natural-language instructions that run with your agent’s privileges. A single malicious or careless skill can exfiltrate secrets, open a reverse shell, mine cryptocurrency, phone home, or hide a delayed trigger. Agent Skill Scanner audits a skill before you trust it: it walks every file, extracts security indicators, runs behavioural detectors, and returns an LLM-generated security report with a risk level, a summary, and per-file findings.

| Attribute | Value |
| --- | --- |
| Type | Agent skill, runs inside your harness |
| Works in | Claude Code, Codex, OpenClaw, opencode, and similar |
| Requires | Python 3.12 or 3.13 |
| Detection | 71 behavioural detectors, 16 threat categories |
| Indicators | 18 indicator types extracted per text file |
| Get it from | skills.sh · GitHub · zip archive |

## How to install

Agent Skill Scanner installs in under a minute with npx via skills.sh, by cloning the GitHub repository, or as a zip archive you drop into your skills directory. It runs inside your agent harness and installs its own Python dependencies on first use.

Works in: Claude Code, Codex, OpenClaw, opencode, Hermes Agent, and similar harnesses.

1. **With npx, from skills.sh (recommended):**

   ```
   npx skills add bitdefender/agent-skill-scanner
   ```

2. **From GitHub:** clone https://github.com/bitdefender/agent-skill-scanner and copy the inner `agent-skill-scanner/` folder into your skills directory (e.g. `~/.claude/skills/`).

3. **As a zip archive:** download https://github.com/bitdefender/agent-skill-scanner/archive/refs/heads/master.zip, unzip it, and move the inner `agent-skill-scanner/` folder into your skills directory.

Then paste this prompt into your agent:

```
Scan the <skill name or path> skill for security risks and show me the report.
```

_Requires Python 3.12 or 3.13 (3.13 recommended). Dependencies install on first use, and optional pieces degrade gracefully: .7z/.rar support, embeddings and signed-update verification each activate only when needed. Scanning .rar targets additionally needs a system unrar or unar binary on your PATH._

To uninstall, delete the agent-skill-scanner folder from your skills directory.

## What it detects

Agent Skill Scanner runs 71 behavioural detectors across 16 threat categories, including code execution, obfuscation, reverse shells, crypto-mining, persistence, time bombs and stealth natural-language directives. It also extracts 18 indicator types from every text file: URLs, IPs, base64 blobs, dangerous shell commands, secret env-var names and invisible Unicode characters among them.

| Threat category | Examples |
| --- | --- |
| Code execution | eval/exec, dynamic __import__, JS Function(), PowerShell Invoke-Expression |
| Subprocess usage | shell=True, os.system, os.popen |
| Obfuscation | base64-decode-then-exec, hex decoding, chr() construction, known encoded payloads |
| Network | requests/httpx/urllib, raw sockets, fetch(), connections to raw IPs |
| File operations | writes, deletions, bulk shutil ops, destructive rm -rf |
| Crypto-mining | xmrig, stratum, mining-pool indicators |
| Reverse shells | /dev/tcp, nc -e, bash -i >&, pty.spawn |
| Download-and-execute | curl … | sh, pip/npm install from URL, npx without approval |
| Credential access | bulk environment-variable harvesting |
| System persistence | cron, systemd, launchd, Windows registry run-keys |
| Privilege escalation | sudo, dangerous chmod, chown root, writes to system paths |
| Path traversal | ../../.., URL-encoded traversal |
| Telemetry | analytics and tracking SDKs, sendBeacon, phone-home |
| Symlink attacks | ln -s, os.symlink, Node fs.symlink |
| Time bombs | date and timestamp-comparison triggers, delayed execution |
| Stealth directives | natural-language exfiltration, covert-action and hidden-memory instructions |

18 indicator types are extracted from every text file: URLs, IPv4 addresses, data/javascript: URIs, emails, base64 blobs (decoded and inspected), percent-encoded URLs, environment-variable references, 25 dangerous shell commands, sensitive file paths, suspicious imports, private/loopback IPs, crypto-wallet addresses, known secret env-var names, paste-service domains, DNS-exfiltration patterns, and invisible Unicode characters.

Structural checks cover hidden dotfiles, package install-hooks (preinstall/postinstall, setup.py cmdclass), per-file SHA-256 and MD5 hashing, and a normalized skill-level hash used for report caching.

## Built for how skills actually hide things

### Layered analysis

Local indicator extraction feeds a server-side LLM that produces the report: a risk level, a plain-language summary, and per-file findings. Enough to decide, without wading through raw indicators.

### Deep archive inspection

The scanner recursively unpacks .zip, .tar.gz, .tar.bz2, .tar, .7z and .rar up to 10 levels deep, with limits of 500 MB uncompressed and 10,000 entries per archive. It skips symlinks rather than following them.

### Prose-aware detection

Natural-language threats hidden in SKILL.md instructions (stealth exfiltration, covert actions, keyword and counter triggers) are first-class detections.

### Semantic embeddings

The scanner computes local sentence embeddings (all-MiniLM-L6-v2, ONNX) to support the analysis. They run on your machine, and you can disable them.

### Privacy-respecting default

In scan mode the scanner transmits only hashes, extracted indicators and metadata; full files are never uploaded. Full-archive upload happens only in the explicit, opt-in submit mode.

### Flexible targets

Scan a directory, an installed skill by name, a .zip archive, or a URL. The skill resolves whatever you refer to in plain language.

## How a scan works

You ask in plain language, “scan the foo skill for security risks”, and the skill does the rest. There is no separate command-line tool to learn.

1. **Resolve** — The scanner resolves the target (a directory, an installed skill name, a zip, or a URL) into a skill root.
2. **Pack & hash** — It packs the skill into a normalized archive and computes a skill-level SHA-256, then checks for a cached report before repeating any work.
3. **Collect & enrich** — It walks, hashes and recurses into every file, then runs all 18 indicator extractors and 71 behavioural patterns over the text content.
4. **Embed** — It computes semantic embeddings on your machine, unless you disable them.
5. **Submit metadata** — Hashes, indicators with short matched excerpts, counts, metadata and embeddings go to the backend. In scan mode it sends no full file contents.
6. **Report** — The backend returns a risk level, summary and findings, rendered as Markdown in your session.

## What leaves your machine

Two modes, both agent-driven. Scan is the default: only hashes, extracted indicators and metadata are transmitted, and full files are never uploaded. Submit is opt-in: the complete skill archive is uploaded for deeper analysis, and only when you explicitly ask for it.

| Mode | Transmitted |
| --- | --- |
| Scan (default) | File hashes (SHA-256/MD5), extracted indicators and pattern matches — including short excerpts of matched content (regex fragments ≤100 chars, decoded base64 snippets ≤500 chars) — file metadata, finding counts, SKILL.md frontmatter, dependency metadata, and local embeddings. Full file contents are not transmitted. |
| Submit (opt-in) | The complete skill archive, uploaded for deep analysis. The agent will not do this unless you explicitly ask. |

**The contract the agent is held to:**
- Scan mode is the default: a casual request never uploads your files.
- Submit is opt-in only: the agent won’t upload the full archive unless you explicitly ask.
- The agent relays, it doesn’t overrule: it presents the backend’s report and never substitutes its own verdict.
- Errors are surfaced as they are: on failure you get the specific reason.
- Self-updates are Ed25519-signature-verified against a key pinned in the client, staged with path-traversal-safe extraction, and rolled back automatically on failure.

> A scan that returns no findings means no known threat patterns were detected — not that the skill is safe.

## What you can point it at

The scanner accepts four target types: a directory, an installed skill name, a zip archive, or a URL.

| Target | Behaviour |
| --- | --- |
| Directory path | Scanned directly as the skill root. |
| Skill name | Resolved via the harness’s known skill directories, project- and user-level. |
| .zip archive | Extracted to a temp directory, then scanned. |
| URL | Sent to the backend for scanning (scan mode only). |

## Built by Bitdefender

Agent Skill Scanner is made by Bitdefender, the company that has protected people and organisations since 2001. The figures and recognitions below describe Bitdefender the company — not the scanner itself.

| Statistic | Value |
| --- | --- |
| threats blocked every year | 50B+ |
| technology patents | 580+ |
| countries protected | 170+ |
| years of AI-driven security | 15+ |
| of employees work in R&D | 50%+ |
| law-enforcement partnerships | 30+ |

**Trusted by Ferrari as cybersecurity partner** — A partnership born from a passion for high performance and technological innovation — Bitdefender supports Ferrari with Advanced Threat Intelligence to improve detection and response to cyber threats. (https://www.bitdefender.com/en-us/scuderiaferrari/)

**Award-winning security software you can trust. Always.** — Consistently top-ranked by the world’s leading independent testing labs and tech publications. (https://www.bitdefender.com/en-us/trusted/)

- PCMag Best of 2026
- Gartner Peer Insights Customers’ Choice 2026
- AV-TEST certified
- Forrester Wave Strong Performer, XDR
- AV-Comparatives approved

**Heritage** — AI in cybersecurity since 2008 — 70+ academic papers and 50+ researchers behind Bitdefender's AI.

## Frequently asked questions

### What is Agent Skill Scanner?

Agent Skill Scanner is a Bitdefender agent skill that audits other agent skills before you install or trust them. It runs 71 behavioural detectors across 16 threat categories, extracts 18 indicator types from every file, and returns an LLM-generated security report with a risk level, summary, and per-file findings.

### How do I install Agent Skill Scanner?

Three ways: run “npx skills add bitdefender/agent-skill-scanner” via skills.sh; clone the GitHub repository and copy the agent-skill-scanner folder into your skills directory; or download the zip archive and unzip it there. It requires Python 3.12 or 3.13 and installs its own dependencies on first use.

### How do I scan a skill?

Ask your agent in plain language, for example “scan the foo skill for security risks”. There is no separate command to learn: the harness invokes the skill, resolves the target (a directory, an installed skill name, a zip, or a URL), and presents the Markdown report.

### Does it upload my files?

Not by default. In scan mode the scanner transmits only file hashes, extracted indicators with short matched excerpts, metadata and local embeddings; full file contents are never uploaded. The opt-in submit mode uploads the complete skill archive for deeper analysis, and the agent will only use it when you explicitly ask.

### Which agents and harnesses does it work with?

It is an agent skill for use inside a harness such as Claude Code, Codex, OpenClaw, or opencode. It is not a standalone CLI tool. Any harness that reads a skills directory and lets the agent execute the skill’s instructions can run it.

### What does a CLEAN result mean?

CLEAN means no known threat patterns were detected, not that the skill is safe. Detection covers 71 behavioural patterns and 18 indicator types, but no scanner proves the absence of malicious intent. Treat the report as strong signal for a trust decision, not a guarantee.

### How much does it cost?

Agent Skill Scanner is available at no charge from skills.sh and GitHub. Use is subject to Bitdefender’s End User License Agreement and Privacy Policy.

| Attribute | Value |
| --- | --- |
| Analyses | Agent skills |
| Status | Available — skills.sh & GitHub |
| Requires | Python 3.12 or 3.13 |
| Made by | Bitdefender |

## Related

- [Bitdefender AI Guardian](https://bitdefender.ai/): the flagship agent-security product
- [GitHub repository](https://github.com/bitdefender/agent-skill-scanner)
- [skills.sh listing](https://www.skills.sh/bitdefender/agent-skill-scanner)
- [All context](https://bitdefender.ai/llms-full.txt)

## Legal

By using Bitdefender Agent Skill Scanner, you confirm that you are over 16 years old and you have read and agreed to Bitdefender’s End User License Agreement and Privacy Policy. ([End User License Agreement](https://www.bitdefender.com/en-us/site/view/subscription-agreement-and-terms-of-services-for-home-user-solutions), [Privacy Policy](https://www.bitdefender.com/en-us/site/view/legal-privacy-policy-for-home-users-solutions))

No security product guarantees complete protection. A scan that returns no findings means no known threat patterns were detected — not that the skill is safe. Effectiveness depends on configuration, runtime environment and the skills analysed. Features and availability may vary.