AgentSec Triage checks a local repository against the threat intelligence used by this page. The current alpha covers repository lockfiles, installed package metadata, payload hashes, and startup configuration for the August 2026 Shai-Hulud campaign.
A clean result is not a security guarantee. The scan is repository-local, does not inspect Git history or host-level persistence, and uses bundled intelligence that only changes when AgentSec is updated.
Verify package author; check download counts; use SafeDep vet.
T007
Hook-Based Exfiltration
Malicious .claude/hooks/ scripts run on agent events with full user privileges.
Claude Code
Examples & mitigation
Examples
SessionStart hook that POSTs environment variables
PostToolUse hook that exfiltrates file paths and content
Review all hooks; forbid auto-running hooks from untrusted repos; maintain hook allowlist.
T008
Credential Theft via Agent
Agent instructed to read credential files and send to attacker.
ClawHavocToxicSkills
Examples & mitigation
Examples
rankaj skill: reads ~/.clawdbot/.env, POSTs to webhook.site
Base64-encoded curl to send ~/.aws/credentials
Block agent access to .env, .aws, .ssh directories; use pre-execution hooks.
CVE Database
Query the threat database directly with jq →
bash — threat-db.json
Loading bash sandbox…
CVE ID ▲
Component ▲
Severity ▲
Fixed In ▲
CVE-2025-53109
Filesystem MCP Server
High
0.6.3
CVE-2025-53110
Filesystem MCP Server
High
0.6.3
CVE-2025-49596
MCP Inspector
Critical
0.14.1
CVE-2025-68143
MCP Git Server
High
2025.9.25
CVE-2025-68144
MCP Git Server
High
2025.12.18
CVE-2025-68145
MCP Git Server
High
2025.12.18
CVE-2025-66416
MCP Python SDK
Medium
1.23.0
CVE-2025-64443
MCP Gateway
Medium
0.28.0
CVE-2026-25536
MCP TypeScript SDK
High
1.26.0
CVE-2025-54135
Cursor IDE
High
1.3.9
CVE-2025-54136
Cursor IDE
High
1.3.9
CVE-2025-66032
Claude Code
High
1.0.93
CVE-2026-24052
Claude Code WebFetch
High
1.0.111
ADVISORY-CC-2026-001
Claude Code (Sandbox Bypass)
High
2.1.34
CVE-2025-53967
Figma MCP Server
High
0.6.3
CVE-2025-9611
Playwright MCP
Medium
0.0.40
CVE-2025-6515
MCP SSE Transport
High
--
CVE-2026-25546
Godot MCP Server
High
0.1.1
CVE-2025-54073
mcp-package-docs
High
0.1.28
CVE-2026-23744
MCPJam
Critical
Audit servers
CVE-2026-30623
LiteLLM
High
check upstream
CVE-2026-40933
Flowise
High
check upstream
CVE-2026-33224
Bisheng
Critical
check upstream
CVE-2025-69256
Serverless Framework
High
check upstream
CVE-2026-6494
Red Hat AAP MCP
High
check upstream
CVE-2026-33032
nginx-ui MCPwn
Critical
patch immediately
ADVISORY-MCP-STDIO-2026-001
MCP stdio transport
Medium
impl-dependent
AgentSec Intelligence
Reviewed security events exported from AgentSec. Each fiche keeps its status, detector coverage, and source references.
monitoring
Tenet described observability data as an indirect injection channel
Tenet reports demonstrations where attacker-controlled log and telemetry content influenced agents that held privileged tools. Reported success rates, detection outcomes, and organization counts are Tenet's claims and are not independent measurements by AgentSec.
Detector coverage: not_detectedAgentSec does not read remote telemetry or observe live tool calls. Repository scans cannot establish exposure to this attack path.
Zenity and Tenet published agent-security reference tools
Zenity documents AI Total for dynamic skill evaluation. Tenet publishes agent-jackstop as a public reference repository, but AgentSec found no visible software license and does not classify it as open source.
Detector coverage: not_applicableThese are external controls. AgentSec records their stated scope but does not execute or endorse them.
Zenity reported delayed payloads in agent-skill typosquats
Zenity reported Paperclip and Browser Use typosquats that accumulated reputation while clean and later directed agents to fetch external payloads. The reported install count is aggregate and is not a victim count.
Detector coverage: not_detectedAgentSec does not inspect skills.sh installations, Python packages, or payloads fetched after repository content is read.
AgentSec preserves JFrog and SafeDep reporting for @keyv/*@6.0.0 as contested intelligence instead of promoting the wildcard package scope to critical and confirmed.
Detector coverage: detectedMatching scoped packages are reported high/contested with source attribution; lifecycle-only evidence remains a separate review finding.
Keyv and cacheable npm supply-chain campaign disclosed
Security researchers reported malicious npm package versions associated with the August 2026 Shai-Hulud campaign. AgentSec treats exact confirmed package/version and payload-hash matches as incident-response evidence.
Detector coverage: partialRepository lockfiles, installed packages, payload hashes, and startup configuration are covered; Git history and host-level evidence are not.
MCP Ruby SDK fixed five transport and resource-exhaustion flaws
GitHub Advisory Database records five MCP Ruby SDK vulnerabilities fixed in mcp gem 0.23.0. The set covers session ownership, request and line limits, DNS-rebinding protection, and session retention.
Detector coverage: not_detectedAgentSec does not inspect Ruby dependency manifests or live MCP transports. The recorded remediation floor is mcp gem 0.23.0.
Perplexity published the Numbat local agent monitor
Perplexity describes Numbat as a local monitor for supported agent event streams, with 52 CEL rules in the reviewed release and enforcement that must be enabled explicitly.
Detector coverage: not_applicableNumbat is a separate runtime control. AgentSec records the source but does not install, invoke, or validate that tool.
Gemini CLI and its GitHub Action patched pre-sandbox CI execution
NVD records that a crafted .gemini/.env file could execute commands on a headless CI host before sandbox initialization. The affected version floors cover both Gemini CLI and the run-gemini-cli GitHub Action.
Detector coverage: not_detectedAgentSec does not parse Gemini configuration or GitHub Actions for this execution path. Upgrade both affected components and review CI trust.
Claude Code patched pre-approved WebFetch domain exfiltration
Anthropic reported that a pre-approved Hugging Face hostname allowed attacker-controlled paths to act as an out-of-band data channel when untrusted content reached Claude Code context. The maintainer identifies 2.1.163 as the first patched release.
Detector coverage: not_detectedAgentSec does not inspect Claude Code versions, WebFetch allowlists, or network activity. Repository scans cannot rule out this exposure.
Largest known malicious AI agent skill campaign. 335 skills deploy Atomic Stealer (AMOS) macOS malware via fake prerequisites in SKILL.md. 6 outlier skills use alternate payloads (reverse shells, credential theft).
Delivery Methods
Fake prerequisites in SKILL.md (e.g., "install this CLI tool first")
Browser data (Chrome, Safari, Firefox, Brave, Edge)
SSH keys and shell history
Telegram sessions, Keychain passwords (macOS)
ToxicSkills
3,984 scanned • Snyk • Feb 2026
Full audit of ClawHub and skills.sh ecosystems. Found 36.82% of all scanned skills have security flaws. 13.4% are critical-risk. 76 contain confirmed malicious payloads.
hightower6eu Publisher
314+ malicious skills • Feb 2026
Publisher account on ClawHub with 314+ confirmed malicious skills. Skills impersonate popular utilities and development tools to exfiltrate credentials and install backdoors. Added to threat-db.yaml v2.1.0.
Profile
314+ malicious skills published
Targets developer tooling and productivity apps
Credential theft via fake API integration workflows
Three malicious Python packages on PyPI masquerading as MCP server implementations. Each spawns a reverse shell to 45.115.38.27:4433 before starting the legitimate MCP server functionality.
Malicious Packages
mcp-runcmd-server
mcp-runcommand-server
mcp-runcommand-server2
Technique
Spawns /bin/sh -i reverse shell before starting MCP server
C2 IP: 45.115.38.27, port 4433
Postmark MCP Squatter
npm • Defender's Initiative • Nov 2025
A malicious npm package named postmark-mcp that copies the official Postmark MCP server with a hidden backdoor injected into the codebase.
Details
Published on npm registry as a squatter of the official Postmark MCP integration
Copies legitimate functionality to appear trustworthy
Hidden backdoor enables remote access
Detection
Verify package author matches official Postmark organization
Check package publish date and download count
Use npx mcp-scan to detect known squatters
Threat Database Browser
Showing 0 of 0 skills
The Sandbox: Strongest Built-In Control, Three Ways to Get It Wrong
Everything above is an attack. This is the one defense the operating system enforces for you. Permission rules decide whether a command runs, from its text. The sandbox decides what it can touch once running, and the kernel holds that line even when a command does more than its name suggests. npm install passes a rule for npm install, then runs the package's postinstall scripts, which are arbitrary code. The rule never saw it coming.
Enabling it does not protect your credentials
The sandbox's default read policy covers the entire machine, and there is no built-in denylist. ~/.ssh and ~/.aws/credentials stay readable by every sandboxed command until you list them in sandbox.credentials.files. Environment variables are worse: sandboxed commands inherit the parent environment unchanged, so a file deny alone still leaves your tokens exposed. Use credentials.envVars as well.
The excludedCommands traps
Verified against Claude Code 2.1.220 on a 200-repository setup. Each trap fails silently: the symptom is always Operation not permitted or a certificate error, never a message naming the exclusion that did not match.
TRAP-1
The bare name never fires
"docker" matches only the zero-argument string, so it never applies to docker ps. The published JSON schema suggests this form, so the usual path is to configure something inert, notice the tool is still confined, and have no way to tell why.
Once an entry matches anywhere in a compound command, every other command in that call runs unsandboxed too, including commands that execute before it. With "git *" present, git status && cat ~/.ssh/id_ed25519 reads the key: file denies, credentials, and the network allowlist are all suspended for that call.
Fix: scope to subcommands, not binaries. "git push *", "git fetch *", and leave local git confined.
An entry matches the command as written, so a wrapper, prefix, or loop sends it back into the sandbox. gh api rate_limit runs unsandboxed and returns. rtk gh api rate_limit is sandboxed and fails. Four characters apart. Any PreToolUse hook that rewrites commands, which token-optimizing proxies do by design, disables every exclusion naming a wrapped binary.
Fix: add the wrapped forms explicitly, and run network git as plain commands rather than inside a loop.
Diagnostic signature: x509: OSStatus -26276
A Go CLI (gh, glab, gcloud, terraform) failing certificate verification with this code means it ran inside the sandbox and could not reach the macOS keychain. It is an exclusion that did not match, not an expired token, not an EDR agent, not a macOS security policy. The same session misdiagnosed it as all three before the real cause was found.
Two companions worth recognizing: git over SSH fails at DNS resolution because the proxy handles HTTP and HTTPS but not port 22 and blocks the ssh-agent socket. And a domain missing from the allowlist hangs to timeout (HTTP 000, curl exit 28) rather than erroring cleanly.
This guide includes two slash commands for security auditing your configuration: /security-check for a quick 30-second scan, and /security-audit for a full 6-phase audit with a score out of 100. See the next section for details.
Built-in Security Commands
/security-check
Quick scan • ~30 seconds • Config vs known threats
$ /security-check
# Checks your config against threat-db.yaml [1/4] Scanning .claude/settings.json... [2/4] Checking MCP server versions... [3/4] Scanning hooks for suspicious patterns... [4/4] Matching against known malicious skills...