skills.rest
XiaoYiWeioXiaoYiWeioCommunity·1 Agent Skills Included

deepsafe-scan

Security scanning for coding agent configs, skills, and secrets

Scans coding agent environments for leaked secrets, PII, prompt injection, and malicious config hooks before you run untrusted code. Audits installed skills, MCP servers, session memory, and deployment settings with 15+ static analyzers and 27+ secret patterns. Runs optional behavioral probes for manipulation, deception, and hallucination, then reports clear risk scores with fix guidance.
75|11
↗
npx skills add XiaoYiWeio/deepsafe-scan --all -g -y
Available:

Tells the agent when to trigger a security scan, which scan commands and modules to run for each situation, and how to present scores and critical findings to the user.

All Skills in This Repository (1)

Pure Emerald Level Indicators
📦 In Repo
XiaoYiWeioXiaoYiWeio

deepsafe-scan

Analyze AI agent configurations for secrets, PII, prompt injection, and backdoors.

Community
Advanced

Frequently Asked Questions

FAQPage Schema
How to install deepsafe-scan?▼

Run `npx skills add XiaoYiWeio/deepsafe-scan --all -g -y` in your terminal to install it globally for your agent.

What does deepsafe-scan check for?▼

It scans agent config files, installed skills, MCP servers, and session memory for leaked API keys, PII, prompt injection, and dangerous auto-executing commands. It can also probe model behavior for manipulation, deception, and hallucination risks.

Do I need an API key to run a security scan?▼

No. The four static modules (posture, skill, memory, hooks) run with zero API keys and no dependencies. Only the optional model behavior probes need an Anthropic or OpenAI key, which is auto-detected.

Does deepsafe-scan work with Claude Code, Cursor, and Codex?▼

Yes. It supports OpenClaw, Claude Code, Cursor, Codex, Windsurf, and OpenCode, scanning each platform's specific config files like .cursorrules, settings.json, and opencode.json.

Why scan a repo before opening it in an AI coding tool?▼

Malicious repos can hide commands in agent config files that auto-execute on startup and steal your SSH keys and API tokens. A quick hooks scan detects these backdoors before they run.

Related Repositories in Software Engineering

View All in Software Engineering→
openclawopenclaw
388.4k

openclaw

Run a personal AI assistant across your devices and chat apps

Official📦 120 Skills
obraobra
280.0k

superpowers

Gives coding agents a disciplined workflow from idea to merged code

Community📦 15 Skills
facebookfacebook
248.4k

react

AI agent skills for building, testing, and porting React core

Official📦 14 Skills