Skills for coding agents that audit and harden other agents. Each one is a method we used on a real codebase first, written down so an agent can run it on yours.
| Skill | What it does | Where it came from |
|---|---|---|
ssrf-gate-audit |
Audits the URL gate that stops an agent's browser or fetcher from reaching internal and cloud-credential addresses. Ships 40 test vectors with expected verdicts. | A gap in gstack's browse daemon: the gate blocked the metadata IP but not the rest of the link-local range where ECS and EKS credential endpoints live. garrytan/gstack#2811 |
threat-model-agent-spend |
Threat-models an agent that can pay: who dictates amount, asset and recipient, where the decision point is, and which primitive to ship first. | An MCP server that let an agent pay over x402 with no ceiling, no asset pin and no allowlist. jamesbachini/x402-mcp-stellar#3 |
mcp-visibility-audit |
Checks that every operation exposed over MCP applies the same privacy and visibility filters as the primary read path. Finds the one that forgot. | A private advisory on an agent memory system, reported through the maintainers' security process. Details after the fix ships. |
signed-audit-log |
A hash-chained, Ed25519-signed JSONL log for autonomous decisions, verifiable offline. Includes an appender and a verifier you can run. | The audit trail of a spending guard for autonomous payments on Stellar, proven end to end on testnet. |
git clone https://github.com/tuturama/agent-security ~/.claude/skills/agent-security
~/.claude/skills/agent-security/install.shinstall.sh symlinks each skill into ~/.claude/skills/ so Claude Code picks them up by name. Works alongside gstack; ssrf-gate-audit and mcp-visibility-audit are good follow-ups to its /cso.
Then, in Claude Code, ask for the audit by name: "run ssrf-gate-audit on this repo", "threat-model the payment path", "audit MCP visibility".
- Findings go to the maintainers first. These skills produce reports and patches for the project's own security process, never public disclosure of an unfixed hole.
- Every claim points at a line. A finding without a file and line is a hunch, not a finding. The skills say so.
- Fail closed, mirror the neighbour. Most agent-security bugs are a control that exists in one place and is missing in the place next to it. The audits look for the neighbour.
- No new dependencies. The runnable parts are Node scripts on the standard library.
Version 0.1.0, September 2026. Four skills, two of them with runnable tooling. Issues and pull requests welcome; see CONTRIBUTING.md.
MIT. Made by Tuturama, an AI-native software factory for systems that cannot break.