Skill Scanner
Scan agent skills for prompt injection, data exfiltration and malicious code before installing.
About Skill Scanner
Skill Scanner is Cisco AI Defense's open-source security scanner for agent skills. It combines pattern rules (YAML and YARA-X), AST and dataflow analysis, and an optional LLM judge to flag prompt injection, data exfiltration and malicious code in a skill before it runs on your machine.
Why it matters: a skill is instructions and code your agent runs with your permissions. The team publishes its own measured results, and they are honest: on a held-out set of 839 malicious skills, rules alone caught 7.7% at high severity, and with the LLM judge 66.7% reached review. Treat it as a first filter, not a certificate.
Python 3.11 or newer, on PyPI as cisco-ai-skill-scanner. SARIF output for GitHub Code Scanning, a pre-commit hook and a reusable GitHub Actions workflow. About 2,600 stars at the time of listing.
More Github
Pulse
Pulse is a free, open-source macOS monitor that sits on the edge of your screen and shows every AI coding limit as a ring: Claude Code, Codex, Cursor, GitHub Copilot, Antigravity, Kiro and dozens more, 77 services in all. It uses the logins you already have, with no Pulse account and no Pulse server. Why it matters: you see a rate limit coming before it stops you mid-task. Every percentage is the one the provider itself reported, estimates are labelled, and an optional burn-rate forecast tells you whether your current pace outlasts the window. Pulse --json prints the readings for tmux, sketchybar or a shell prompt. Swift and SwiftUI, macOS 14 or newer on Apple silicon and Intel. Apache-2.0, about 530 stars at the time of listing.
Strands Box
Strands Box is an open-source sandbox engine for AI agents. It runs any agent program inside OS-level isolation, then checks its shell commands, Python code, outbound network requests and MCP tool calls against policies written in Dogwood. Anything the policy engine checks is denied unless a rule permits it. Why it matters: the rules can depend on what the agent already did. A file read through the shell can make the gateway refuse a later outbound HTTP request, which is the exfiltration pattern you actually worry about. The gateway also injects API credentials into permitted requests, so the agent never holds the secrets. Written in Rust, Apache-2.0, about 390 stars at the time of listing. Still a preview: macOS on Apple silicon only for now, with Linux planned.
AOCI-CODE
AOCI-CODE has your coding agent write one line per file (what it is for, what to read with it, what callers depend on, what must not go wrong) and keeps that index in the repository, versioned by Git. A local MCP server hands the right entries to Claude Code, Codex, Cursor or OpenCode at the start of every task. Why it matters: the agent stops re-reading the repo on every task, and the map survives a new conversation, a new agent or a new owner. After the first index, the server flags the entries that code changes made stale. It can index MySQL and PostgreSQL schemas too, structure only, never business data. The first index takes about an hour per 200,000 lines, depending on the model. Local only, a Go binary, around 1,200 stars at the time of listing.
agentacct
agentacct records what your coding agents actually did across projects: tool calls, files changed, checks run, tokens and estimated cost. Each task gets a Work Receipt with its sessions, outcome, cost and a timeline, in a local dashboard, a terminal app or a macOS app. Why it matters: it keeps what an agent reported apart from what was verified. A result only counts as Verified when checks pass after the last recorded change, so an agent saying "done" never passes for proof. Usage filters by agent, model or provider show where the spend goes. Works with Claude Code, Codex, OpenCode and more. Python 3.11+, install with pipx install agentacct. MIT licensed, early alpha, no login and no telemetry.
deja-vu
deja-vu indexes the session history your coding agents already left on disk, months back, and hands the relevant part to whichever agent is working now: Claude Code, Codex, Cursor, opencode and 34 more. Recall arrives at session start, before a file is edited, and after a command fails. Why it matters: a fix found in one agent comes back in another, and the memory survives compaction. Across 43 measured compactions, the author found summaries kept 77% of the decisions and 0.2% of the commands; deja hands back the rest. No model, no embeddings, no server, and keys and tokens are stripped as it indexes. One Go binary for macOS, Linux and Windows (Homebrew, Scoop, winget, npm or go install). MIT licensed, about 1,100 stars at the time of listing.