sigwood

Sysdig is a cloud-security platform that provides real-time visibility from runtime through development. It is described in the video context as a customer-side CVE-scanning tool that produces security reports; its website also presents capabilities for assessing cloud risk, prioritizing critical risks, detecting threats, and responding to them.

Zero Breach is a local, read-only Python scanner for traces of the AdFection and Candiru ad-delivered spyware campaigns. It examines browser histories, cookies as host names and timestamps, caches, connection records, file fingerprints, per-user Windows COM registrations, known file paths, hosts-file entries, and DNS resolver data against published indicators, then grades findings as on-disk, persistence, contacted, DNS-record, configured, or referenced evidence. It can export indicator data and findings for STIX, MISP, and DNS or ad-blocking formats. Default checks use only the Python standard library, make no intentional network requests, require no administrator access, and run on Windows, macOS, and Linux; optional Candiru file-pattern checks require the pinned YARA-X engine. The project emphasizes that a clean result is not proof that a device is safe, because unsupported locations, unrecorded DNS activity, expired traces, and spyware designed to evade such checks remain outside its coverage. The scanner is licensed under Apache License 2.0, while its indicator data is released under CC0 1.0.

Zero Breach Toolkit is a free, open-source Python scanner for traces of known mercenary spyware, including Pegasus, Predator, Graphite and Candiru. It checks Windows, macOS and Linux computers, AndroidQF collections, and local iPhone or iPad evidence such as encrypted backups, extracted file systems and sysdiagnose archives. The toolkit compares browser, application, system, startup, network, log, file and phone records with published indicator lists. It is read-only with respect to the scanned evidence and system settings, produces readable and JSON reports with evidence grades and coverage gaps, and does not make network requests during ordinary scans. Indicator updates and optional Android collection are separate operations. A clean result is not presented as proof that a device is safe because the scanner only detects published indicators and cannot check every artifact or identify new or unpublished spyware. The project runs from source with Python 3.8 or newer and does not require administrator access for standard checks. Its code is licensed under Apache License 2.0; curated indicator files are released under CC0 1.0, while externally downloaded indicator lists retain their publishers' terms.

Codex Security is an OpenAI CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in authorized code repositories. It scans directories and codebases, including repository changes, uses AI-assisted analysis to trace attack paths and apply custom threat models, validates findings, and can generate reviewable patches and exports in SARIF, JSON, and CSV formats. The CLI supports CI use with an API key and can stop builds at a selected severity threshold. The package also supports configurable deep scans, worker and subagent counts, time limits, containerized bulk scans, and a preview findings service. The service stores findings and embeddings in SQLite, provides paginated listings and a read-only dashboard, identifies potential duplicates through embedding similarity, and allows completed findings to be published and deduplicated through the CLI or SDK. It requires Node.js 22.13.0 or later and Python 3.10 or later, and can use OpenAI or other documented inference providers.

SkillSpector is an open-source security scanner for AI agent skills, developed by NVIDIA. It scans Git repositories, URLs, ZIP archives, directories, and individual skill files before installation, looking for prompt injection, data exfiltration, privilege escalation, supply-chain issues, dangerous code, MCP permission problems, tool poisoning, and other malicious patterns. Its two-stage pipeline combines static analysis—including regex, Python AST, taint tracking, YARA signatures, and OSV.dev dependency lookups—with optional LLM-based semantic evaluation. It produces terminal, JSON, Markdown, or SARIF reports containing findings, severity labels, a 0–100 risk score, and installation recommendations. Baselines can suppress accepted findings, and the CLI can be used in CI or install gates through exit codes and machine-readable output. SkillSpector can also run as an MCP server callable by compatible agents. It does not execute scanned skills or sandbox them; optional LLM analysis sends eligible file contents to the configured provider, while dependency checks query OSV.dev. The project is distributed under the Apache License 2.0 and is part of NVIDIA's Verified Skills pipeline.