agent-self-protection - Full-spectrum defensive layer for AI agents — 10-l

项目说明

Agent Self-Protection 🛡️

> Full-spectrum defensi for AI agents — multi-engine malware scanning, static code analysis, network exfiltration detection, credential leak scanning, runtime beha monitoring, sandboxed execution, prompt injection defense, and sub-agent delegation security.

Why?

AI agents that browse, download, clone, install, or execute code from external sources are to:

This skill makes the agent in to compromise from the outside world. Every byte that crosses the agent's boundary is suspect until proven safe.

Features

10-Layer Defense

| Layer | Engine | What it detects |
|-------|--------|----------------|
| L1: Reputation | reputation_check.py | URLhaus, WHOIS, SSL, npm/PyPI registry |
| L2: Network Guard | network_guard.py | Exfil endpoints (pastebin, webhook, ngrok, Tor, mining pools, DNS tunneling) |
| L3: Malware Scan | malware_scan.py | ClamAV, YARA rules, entropy analysis, magic bytes, hash lookup |
| L4: Static Analysis | static_analyzer.py | Reverse shells, eval/exec, exfiltration, persistence, cryptominers, obfuscation |
| L5: Beha | beha.py | Runtime process/fs/network monitoring |
| L6: Credentials | credential_scanner.py | API keys, private keys, JWT, high-entropy secrets |
| L7: Sandbox Exec | sandbox_exec.py | bwrap/unshare isolation + rlimits + en |
| L8: Quarantine | quarantine.py | SQLite-tracked file isolation |
| L9: Prompt Injection | prompt_injection_guard.py | Indirect injection, ChatML smuggling, zero-width chars, bidi o |
| L10: Output Sanitizer | output_sanitizer.py | Credential redaction, zero-width stripping, ANSI/HTML cleanup |

Sub-Agent Delegation Security

Sub-agents spawned via delegate_task get no automatic skill loading (skip_context_files=True, skip_memory=True). This skill includes a mandatory security prefix that must be injected into every delegation context, plus a delegate_safe.py wrapper that auto-prepends it.

Quick Start

As a Hermes Skill

Standalone Usage

Indi Engines

Architecture

Dependencies

Required (Python 3.10+)

Optional (enhanced detection)

Integration with Hermes Agent

Auto-acti

The skill auto-activates before:

Sub-Agent Delegation

Or use the wrapper:

Threat Model

Based on:

Attack Surfaces

| Surface | Threats |
|---------|---------|
| Web | Phishing, drive-by downloads, malicious JS, credential capture, hidden iframes |
| Files | Trojans, droppers, macro malware, polyglots, zero-days |
| Packages | Supply chain attacks (e, node-ipc, ua-parser-js incidents) |
| Code | Reverse shells, eval/exec abuse, obfuscation, exfiltration |
| LLM I/O | Indirect prompt injection, ChatML smuggling, zero-width steganography |

YARA Rules

16 rules co:

License

MIT License. See LICENSE.

Acknowledgments

Inspired by:

项目信息

开发语言：Python

Star 数：3

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Full-spectrum defensive layer for AI agents — 10-layer malware scan, static analysis, exfil detection, prompt injection defense, and sub-agent delegation security展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。