agentshield-audit_skill

Overview

This skill initiates and manages AgentShield security audits for AI agents, producing verifiable trust certificates and local cryptographic identity keys. It automates detection of agent metadata, runs a short security test suite, and issues an Ed25519-signed certificate valid for 90 days. No registration or API key is required for basic use.

How this skill works

The skill auto-detects your agent name and platform (or accepts manual input), generates an Ed25519 keypair stored locally, and runs a set of checks like prompt extraction, instruction override, tool permission, memory isolation, and secret leakage detection. If the agent passes, the skill issues a signed JWT certificate and stores it in the workspace; verification can be done locally or via a public verification URL. Private keys never leave the workspace and audits are rate-limited to prevent abuse.

When to use it

• You want to audit your agent's security posture before deployment.
• You need a verifiable trust certificate for inter-agent communication.
• You want to verify another agent's certificate before trusting it.
• You are setting up secure channels between agents or services.
• You want to check for secret leakage or instruction override vulnerabilities.

Best practices

• Run an audit after major changes to prompts, tools, or memory handling.
• Keep your private key files inside the workspace and back up secure copies.
• Re-audit every 90 days or after adding new integrations to maintain certificate validity.
• Use manual name/platform flags if auto-detection fails to ensure correct identity.
• Monitor audit logs and act on critical failures immediately.

Example use cases

• Generate an agent identity and certificate before enabling multi-agent workflows.
• Verify a third-party agent's certificate before granting it API or tool access.
• Run a quick pre-deployment security check to score and harden the agent.
• Integrate the low-level audit client into CI to enforce security gates.
• Display or share the agent certificate to prove ownership during partnerships.