Slowmist Agent Security Framework

If you're building agents that install third-party skills, pull from GitHub repos, or process user-shared URLs, this gives you a structured paranoia framework. It walks through six review types (skills, repos, URLs, on-chain addresses, products, social shares) with red flag databases for obfuscation, credential theft, and prompt injection patterns. The risk rating system is clear: green means inform and proceed, red means block until human approval, reject means refuse outright. Built by SlowMist, so the threat modeling leans heavily on adversarial scenarios like typosquatting dependencies and base64-encoded exfiltration endpoints. Treat it as a checklist for agents operating in environments where every external input could be hostile.

Install to Claude Code

npx -y skills add aradotso/security-skills --skill slowmist-agent-security-framework --agent claude-code