Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
- Updated version to 0.1.10. - Updated metadata to remove deprecated fields: "primaryEnv" and "env". - No functional or behavioral changes to scanning or CLI.
What This Skill Does
Aegis runs deterministic static analysis (AST parsing, Semgrep, and 15 specialized scanners) on AI agent skills and MCP tools to produce CWE-mapped, OWASP-tagged security reports with 0-100 risk scores. It generates Ed25519-signed lockfiles for tamper detection and supports optional LLM-powered intent analysis via Gemini, OpenAI, Claude, or local models. Runs fully offline by default.
Deterministic AST and Semgrep analysis with CWE/OWASP mapping produces reproducible, cryptographically signed reports that manual review or basic safety summaries cannot match.
When to use it
- Scanning a new MCP server before adding it to Cursor
- Generating a signed lockfile before publishing a skill
- Running security gates in CI pipelines for skill deployments
- Auditing a third-party plugin for secret leakage or shell injection
- Verifying a skill's code hasn't changed since its last audit
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Is this MCP skill safe to install?
- 1Runs `aegis scan ./skill-directory --no-llm` on the target skill
- 2Parses AST and applies 15 specialized scanners including secret detection and shell analysis
- 3Maps findings to CWE and OWASP categories with severity tiers
- 4Assigns a 0-100 composite risk score and a persona classification
- 5Outputs a full security report to the console or as JSON for CI
Security report listing scoped capabilities, flagged patterns, risk score, and a persona (e.g. 'Permission Goblin' or 'LGTM')
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.