Agentvulnly Vulnerability Scanner
by @krishnakumarmahadevan-cmd
Scan AI agents for security vulnerabilities including token theft, prompt injection, command injection, tool poisoning, and rug pull attacks. Use when auditi...
clawhub install agentvulnly-vulnerability-scannerπ About This Skill
name: agentvulnly-vulnerability-scanner description: Scan AI agents for security vulnerabilities including token theft, prompt injection, command injection, tool poisoning, and rug pull attacks. Use when auditing AI agent security, assessing MCP server risks, evaluating OpenClaw skill safety, scanning autonomous agent deployments, or reviewing AI agent architecture for security flaws. version: 1.0.0 homepage: https://portal.toolweb.in metadata: openclaw: emoji: "π" requires: env: - TOOLWEB_API_KEY bins: - curl primaryEnv: TOOLWEB_API_KEY os: - linux - darwin - win32 category: security
AgentVulnly β AI Agent Vulnerability Scanner ππ‘οΈ
Scan AI agent deployments for 7 critical security vulnerabilities. Analyzes agent architecture, framework, tools, authentication, data flow, and security controls to identify token theft, prompt injection, command injection, tool poisoning, rug pull attacks, and more. Returns vulnerability findings with impact scores, exploitability ratings, and remediation guidance.
Built by a CISSP/CISM certified security professional at ToolWeb.in
When to Use
Prerequisites
TOOLWEB_API_KEY β Get your API key from portal.toolweb.incurl must be available on the systemCRITICAL: Always Call the API
API Endpoint
POST https://portal.toolweb.in/apis/security/agentvulnly
7 Vulnerability Checks
| ID | Vulnerability | Impact | Exploitability | |----|--------------|--------|----------------| | AVULN-001 | Token / Credential Theft | 8/10 | Easy | | AVULN-002 | Token Passthrough | 8/10 | Easy | | AVULN-003 | Rug Pull Attack | 7/10 | Easy | | AVULN-004 | Prompt Injection | 10/10 | Trivial | | AVULN-005 | Command Injection | 10/10 | Easy | | AVULN-006 | Tool Poisoning | β/10 | β | | AVULN-007 | Unauthenticated Access | β/10 | β |
Workflow
1. Gather inputs about the AI agent architecture:
Agent identity:
- agentName β Name of the agent (e.g., "My OpenClaw Agent", "Customer Support Bot")
- agentDescription β What the agent does
- agentFramework β Framework used (e.g., "OpenClaw", "LangChain", "CrewAI", "AutoGen", "Custom")
- llmProvider β LLM backend (e.g., "Anthropic Claude", "OpenAI GPT-4", "Local Ollama", "Google Gemini")
Architecture details:
- toolsUsed β List of tools/skills, e.g., ["web_browsing", "file_access", "code_execution", "shell_commands", "email", "calendar", "github"] (default: [])
- authMechanism β How the agent authenticates (e.g., "API keys in environment", "OAuth tokens", "No authentication", "JWT tokens")
- dataFlow β How data moves through the agent (e.g., "User β Agent β LLM β Tools β User", "Bidirectional with external APIs")
- deploymentType β Where it runs (e.g., "Local machine", "Cloud server", "Docker container", "Kubernetes")
- tokenHandling β How tokens/credentials are managed (e.g., "Environment variables", "Hardcoded", "Vault/secrets manager", "Config file")
- inputSanitization β Input validation approach (e.g., "None", "Basic filtering", "Comprehensive validation", "ML-based detection")
- dependencyManagement β How dependencies are managed (e.g., "npm/pip install", "Locked versions", "Vendored", "No management")
- accessControl β Access control model (e.g., "No restrictions", "Role-based", "Sandboxed", "Human-in-the-loop for sensitive actions")
Security flags (true/false):
- mcpServers β Uses MCP servers? (default: false)
- multiAgent β Multi-agent system? (default: false)
- humanInLoop β Human approval for actions? (default: false)
- loggingEnabled β Audit logging enabled? (default: false)
- sandboxed β Runs in a sandbox? (default: false)
- rateLimited β Rate limiting in place? (default: false)
2. Call the API:
curl -s -X POST "https://portal.toolweb.in/apis/security/agentvulnly" \
-H "Content-Type: application/json" \
-H "X-API-Key: $TOOLWEB_API_KEY" \
-d '{
"scanData": {
"agentName": "",
"agentDescription": "",
"agentFramework": "",
"llmProvider": "",
"toolsUsed": ["", ""],
"authMechanism": "",
"dataFlow": "",
"deploymentType": "",
"tokenHandling": "",
"inputSanitization": "",
"dependencyManagement": "",
"accessControl": "",
"mcpServers": true,
"multiAgent": false,
"humanInLoop": true,
"loggingEnabled": true,
"sandboxed": false,
"rateLimited": true
},
"sessionId": "",
"timestamp": ""
}'
3. Present results with vulnerability findings, severity, and remediation.
Output Format
π AI Agent Vulnerability Scan Report
βββββββββββββββββββββββββββββββββββββAgent: [agentName]
Framework: [agentFramework] | LLM: [llmProvider]
Deployment: [deploymentType]
π΄ CRITICAL Vulnerabilities:
AVULN-004: Prompt Injection β Impact: 10/10
AVULN-005: Command Injection β Impact: 10/10
π HIGH Vulnerabilities:
AVULN-001: Token Theft β Impact: 8/10
AVULN-002: Token Passthrough β Impact: 8/10
π‘ MEDIUM Vulnerabilities:
AVULN-003: Rug Pull Attack β Impact: 7/10
β
Security Controls Detected:
[List of controls in place]
π§ Remediation Priority:
1. [Fix] β Addresses AVULN-004
2. [Fix] β Addresses AVULN-005
3. [Fix] β Addresses AVULN-001
π Full scan report powered by ToolWeb.in
Error Handling
TOOLWEB_API_KEY is not set: Tell the user to get an API key from https://portal.toolweb.inExample Interaction
User: "Scan my OpenClaw agent for vulnerabilities"
Agent flow: 1. Ask: "I'll scan your agent setup. Tell me: - What tools/skills does it use? - How are API keys and tokens managed? - Is it sandboxed? Does it use MCP servers? - Is human-in-the-loop enabled for sensitive actions?" 2. User responds with details 3. Call API with full scanData 4. Present vulnerability findings with remediation priorities
Pricing
About
Created by ToolWeb.in β a security-focused MicroSaaS platform with 200+ security APIs, built by a CISSP & CISM certified professional. Trusted by security teams in USA, UK, and Europe and we have platforms for "Pay-per-run", "API Gateway", "MCP Server", "OpenClaw", "RapidAPI" for execution and YouTube channel for demos.
Related Skills
Tips
β‘ When to Use
βοΈ Configuration
TOOLWEB_API_KEY β Get your API key from portal.toolweb.incurl must be available on the system