agentfend

Scan your AI skills for security vulnerabilities before they run in production.

Works with Claude skills, MCP configs, cursor rules, and any AI agent configuration files.

npx agentfend

Install

npm install -g agentfend

Or run without installing:

npx agentfend

How it works

AgentFend scans the /skills directory of your project and sends each skill to the Onyx V3 analysis engine. It returns a security score, detected risks, and recommendations.

Your project structure should look like this:

my-project/
└── skills/
    ├── my-skill/
    │   ├── SKILL.md
    │   └── index.ts
    └── another-skill/
        └── SKILL.md

Usage

Scan the current directory

agentfend

Scan a specific path

agentfend ./path/to/project

Verbose output (show code snippets for each finding)

agentfend --verbose

JSON output (for CI pipelines)

agentfend --json

Install a skill from the registry

agentfend install <skill-id>

# Short alias
agentfend i <skill-id>

# Install to a specific directory
agentfend install <skill-id> --dir ./projects/my-app

This downloads the skill into ./skills/<skill-name>/ and prints the file list. Run agentfend afterwards to verify its security score.

API key

The free tier allows 1 scan per day. With an API key you get 100 scans per day.

Get your key at agentfend.com/settings, then:

agentfend auth

To remove your key:

agentfend auth --logout

Your key is stored locally in ~/.config/agentfend/config.json.

CI integration

agentfend --json exits with code 1 if any skill has a critical risk or a score below 50.

# GitHub Actions example
- name: Scan AI skills
  run: npx agentfend --json

Commands

| Command | Description | |---|---| | agentfend [path] | Scan the /skills directory (default: .) | | agentfend install <id> | Install a skill from the registry | | agentfend auth | Save your API key | | agentfend auth --logout | Remove your saved API key | | agentfend help | Show usage and examples |

Options

| Flag | Description | |---|---| | -v, --verbose | Show code snippets for each finding | | --json | Raw JSON output, exit 1 on critical findings |

Links

• Website
• Skill registry