Agent Security Scanning

# Agent Security Scanning

Part of [Agent Skills™](https://github.com/itallstartedwithaidea/agent-skills) by [googleadsagent.ai™](https://googleadsagent.ai)

## Description

Agent Security Scanning detects vulnerabilities in AI-generated code before it reaches production. The agent applies OWASP Top 10 for LLM Applications, scans for known CVEs in dependencies, identifies prompt injection vectors, and flags insecure patterns specific to agent-generated code—such as unsanitized dynamic SQL, eval() usage, and unvalidated deserialization.

AI code generators produce code that "works" but frequently contains security vulnerabilities invisible to functional testing. Studies show that AI-generated code contains exploitable vulnerabilities at higher rates than human-written code, particularly in input validation, authentication, and cryptographic operations. This skill applies security analysis specifically calibrated for the patterns that AI agents produce.

The scanning pipeline covers three layers: static analysis of generated code (injection, XSS, SSRF), dependency vulnerability scanning (CVE database matching), and agent-specific threat modeling (prompt injection, tool misuse, data exfiltration through tool calls). Each finding includes a severity rating, CWE classification, and a concrete remediation with code example.

## Use When

- Reviewing AI-generated code before committing or deploying
- Scanning dependencies for known CVEs after `npm install` or `pip install`
- Auditing agent tool call patterns for potential misuse
- Implementing security gates in CI/CD pipelines
- The user requests security review, vulnerability scan, or penetration testing
- Building applications that handle user input, authentication, or payments

## How It Works

```mermaid
graph TD
    A[AI-Generated Code] --> B[Layer 1: Static Analysis]
    B --> C[Injection: SQL, XSS, SSRF, Command]
    B --> D[Auth: Hardcoded Secrets, Weak Crypto]
    B --> E[Data: PII Exposure, Logging Secrets]
    A --> F[Layer 2: Dependency Scan]
    F --> G[CVE Database Match]
    F --> H[License Compliance]
    A --> I[Layer 3: Agent Threat Model]
    I --> J[Prompt Injection Vectors]
    I --> K[Tool Call Audit]
    I --> L[Data Exfiltration Paths]
    C --> M[Severity Classification + CWE]
    D --> M
    E --> M
    G --> M
    J --> M
    K --> M
    L --> M
    M --> N[Remediation Report]
```

The three-layer scan runs in parallel. Static analysis catches code-level vulnerabilities, dependency scanning catches known CVEs, and agent threat modeling catches risks unique to AI-powered applications.

## Implementation

```python
import re
from dataclasses import dataclass

@dataclass
class SecurityFinding:
    severity: str  # CRITICAL, HIGH, MEDIUM, LOW
    cwe: str
    title: str
    file: str
    line: int
    description: str
    remediation: str

class AgentSecurityScanner:
    PATTERNS = [
        {
            "name": "SQL Injection",
            "pattern": r'f["\'].*(?:SELECT|INSERT|UPDATE|DELETE).*\{.*\}',
            "severity": "CRITICAL",
            "cwe": "CWE-89",
            "remediation": "Use parameterized queries instead of string interpolation",
        },
        {
            "name": "Command Injection",
            "pattern": r'(?:os\.system|subprocess\.call|exec)\s*\(.*(?:f["\']|\+\s*\w)',
            "severity": "CRITICAL",
            "cwe": "CWE-78",
            "remediation": "Use subprocess with list args, never shell=True with user input",
        },
        {
            "name": "Hardcoded Secret",
            "pattern": r'(?:password|secret|api_key|token)\s*=\s*["\'][^"\']{8,}["\']',
            "severity": "HIGH",
            "cwe": "CWE-798",
            "remediation": "Use environment variables or a secrets manager",
        },
        {
            "name": "Eval Usage",
            "p