ThreatXtension

VirusTotal is a threat-intelligence service that provides external intelligence used to enrich browser-extension analysis.

Zero Breach Toolkit is a free, open-source Python scanner for traces of known mercenary spyware, including Pegasus, Predator, Graphite and Candiru. It checks Windows, macOS and Linux computers, AndroidQF collections, and local iPhone or iPad evidence such as encrypted backups, extracted file systems and sysdiagnose archives. The toolkit compares browser, application, system, startup, network, log, file and phone records with published indicator lists. It is read-only with respect to the scanned evidence and system settings, produces readable and JSON reports with evidence grades and coverage gaps, and does not make network requests during ordinary scans. Indicator updates and optional Android collection are separate operations. A clean result is not presented as proof that a device is safe because the scanner only detects published indicators and cannot check every artifact or identify new or unpublished spyware. The project runs from source with Python 3.8 or newer and does not require administrator access for standard checks. Its code is licensed under Apache License 2.0; curated indicator files are released under CC0 1.0, while externally downloaded indicator lists retain their publishers' terms.

Codex Security is an OpenAI CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in authorized code repositories. It scans directories and codebases, including repository changes, uses AI-assisted analysis to trace attack paths and apply custom threat models, validates findings, and can generate reviewable patches and exports in SARIF, JSON, and CSV formats. The CLI supports CI use with an API key and can stop builds at a selected severity threshold. The package also supports configurable deep scans, worker and subagent counts, time limits, containerized bulk scans, and a preview findings service. The service stores findings and embeddings in SQLite, provides paginated listings and a read-only dashboard, identifies potential duplicates through embedding similarity, and allows completed findings to be published and deduplicated through the CLI or SDK. It requires Node.js 22.13.0 or later and Python 3.10 or later, and can use OpenAI or other documented inference providers.

AgentGuard is a web-based scanner for AI-agent Skills, including SKILL.md instructions. It combines deterministic pattern checks with AI-assisted analysis to identify capabilities and risks such as shell-command execution, file-system access, environment-variable and credential access, network requests, external downloads, suspicious URLs, obfuscated instructions, prompt-injection patterns, and destructive operations. It produces a trust report with security and quality scores, a risk rating, detected capabilities, findings, explanations, and recommendations. The scanner is free to use, requires no account, accepts up to 80,000 characters of Skill text, and is designed for analysis before installation.

SkillSpector is an open-source security scanner for AI agent skills, developed by NVIDIA. It scans Git repositories, URLs, ZIP archives, directories, and individual skill files before installation, looking for prompt injection, data exfiltration, privilege escalation, supply-chain issues, dangerous code, MCP permission problems, tool poisoning, and other malicious patterns. Its two-stage pipeline combines static analysis—including regex, Python AST, taint tracking, YARA signatures, and OSV.dev dependency lookups—with optional LLM-based semantic evaluation. It produces terminal, JSON, Markdown, or SARIF reports containing findings, severity labels, a 0–100 risk score, and installation recommendations. Baselines can suppress accepted findings, and the CLI can be used in CI or install gates through exit codes and machine-readable output. SkillSpector can also run as an MCP server callable by compatible agents. It does not execute scanned skills or sandbox them; optional LLM analysis sends eligible file contents to the configured provider, while dependency checks query OSV.dev. The project is distributed under the Apache License 2.0 and is part of NVIDIA's Verified Skills pipeline.