Package io.agentscope.harness.agent.skill.curator

Class SkillSecurityScanner

java.lang.Object

io.agentscope.harness.agent.skill.curator.SkillSecurityScanner

public final class SkillSecurityScanner
extends Object

Static-analysis scanner for SKILL.md and skill support files. Ported from hermes-agent's tools/skills_guard.py regex library plus the trust-level × verdict install policy.

Detection categories (one or more regexes per category):

• SkillSecurityScanner.Category.EXFILTRATION — data exfiltration via curl/wget POST
• SkillSecurityScanner.Category.INJECTION — prompt-injection markers in markdown
• SkillSecurityScanner.Category.DESTRUCTIVE — rm -rf /, mkfs, dd of=/dev
• SkillSecurityScanner.Category.PERSISTENCE — crontab / systemd / shell-rc tampering
• SkillSecurityScanner.Category.NETWORK — listen sockets / reverse shells
• SkillSecurityScanner.Category.OBFUSCATION — base64 → bash, eval $(curl …), etc.

The scan returns a SkillSecurityScanner.Verdict (SAFE / CAUTION / DANGEROUS) plus the list of findings. Callers (e.g. SkillManageTool, HarnessAgent.promoteSkill) consult shouldAllow(TrustLevel, Verdict) to map verdict + provenance to an install decision.

This is intentionally a Java-side approximation, not a security boundary. Skills always run inside whatever sandbox the host configured (see ShellExecuteTool); the scanner is here to catch the obvious mistakes during authoring, NOT to replace the sandbox.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static enum	SkillSecurityScanner.Category
static final record	SkillSecurityScanner.Finding
static final record	SkillSecurityScanner.ScanResult
static enum	SkillSecurityScanner.Severity
static enum	SkillSecurityScanner.TrustLevel	Where the skill came from.
static enum	SkillSecurityScanner.Verdict

Method Summary

Modifier and Type	Method	Description
static SkillSecurityScanner.ScanResult	scan(String skillName, String skillMd, Map<String,String> resources)	Scan a complete skill: SKILL.md + every support file.
static SkillSecurityScanner.ScanResult	scanSingleFile(String relPath, String content)	Scan a single file (used after write_file / patch).
static boolean	shouldAllow(SkillSecurityScanner.TrustLevel trust, SkillSecurityScanner.Verdict verdict)	Map (trust × verdict) to an install decision.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

scan

public static SkillSecurityScanner.ScanResult scan(String skillName,
 String skillMd,
 Map<String,String> resources)

Scan a complete skill: SKILL.md + every support file. resources is a map of relative path → content (matching AgentSkill.getResources()). Returns the most severe verdict across all files.

scanSingleFile

public static SkillSecurityScanner.ScanResult scanSingleFile(String relPath,
 String content)

Scan a single file (used after write_file / patch).

shouldAllow

public static boolean shouldAllow(SkillSecurityScanner.TrustLevel trust,
 SkillSecurityScanner.Verdict verdict)

Map (trust × verdict) to an install decision. Mirrors hermes tools/skills_guard.py::INSTALL_POLICY.

Returns:

true if writing the skill should proceed; false if it must be blocked / rolled back.