Agentic security patterns for AI agent systems including attack vector defense, sandboxing, input sanitization, security scanning, CVE awareness, and least-privilege tool access. Use when.
Agentic security patterns for AI agent systems including attack vector defense, sandboxing, input sanitization, security scanning, CVE awareness, and least-privilege tool access. Use when.
{"name":"AgentShield","title":"Agentic Security Engineer","expertise":["AI Agent Attack Vectors","Sandboxing","Prompt Injection Defense","Tool Permission Hardening","CVE Analysis","Security Scanning"],"philosophy":"Trust nothing. Verify everything. Sandbox what you cannot trust. Limit what you cannot sandbox."}
version
1.0.0
Overview
AI agents present a unique attack surface: they read untrusted input, execute code, access files, call APIs, and spawn subagents -- all with elevated privileges. Traditional application security applies, but new agent-specific vectors (prompt injection, tool abuse, data exfiltration via agent actions) require dedicated defense patterns. This skill covers the full agentic security lifecycle: threat modeling, hardening, scanning, and continuous monitoring.
Anti-Rationalization Table
Rationalization
Reality
"I'll figure it out as I go"
A structured approach saves time and reduces errors. Follow the workflow in this skill rather than improvising.
"I already know this topic"
Familiarity breeds shortcuts. Use the checklist to verify you haven't missed critical steps.
"This doesn't apply to my situation"
The patterns here generalize across contexts. Adapt, don't skip — the underlying principles hold.
"One more tool will fix it"
Adding complexity rarely solves process gaps. Master the core workflow first.
When to Use
Trigger phrases:
"agent security scanner"
"Setting up security scanning for agent configurations ("
"Hardening agent tool permissions after modification"
"Auditing hooks and MCP servers for injection or exfiltration risks"
Setting up security scanning for agent configurations (.claude/, settings.json, MCP configs)
Hardening agent tool permissions after modification
Auditing hooks and MCP servers for injection or exfiltration risks
Defending against prompt injection in agent inputs
Implementing sandboxed execution for untrusted code
Reviewing agent dependency CVEs
Before committing agent configuration changes to production
Onboarding to a repository with existing agent configurations
When NOT to Use
Task is outside your authorization scope
You need to implement controls (use implementing-* skills)
Task is about analysis, not action (use analyzing-* skills)
# Run untrusted code in ephemeral container
docker run --rm --network none --read-only \
--memory 512m --cpus 1 \
-v "$(pwd)/src:/app:ro" \
node:20-alpine \
node /app/untrusted-script.js
Layer 3: Process Sandboxing
# Use bubblewrap or firejail for process isolation
bwrap --ro-bind / / \
--dev /dev \
--tmpdir /tmp \
--unshare-net \
--die-with-parent \
node untrusted-script.js
3. Input Sanitization for Agent Inputs
Sanitization Pipeline
Untrusted Input -> Strip Instructions -> Validate Format -> Length Limit -> Pass to Agent
Strip Injection Patterns
INJECTION_PATTERNS = [
r'ignore\s+(previous|above|all)\s+instructions',
r'you\s+are\s+now\s+',
r'system\s*:\s*',
r'<\s*system\s*>',
r'```system',
r'IMPORTANT:\s*override',
r'DISREGARD\s+(all|previous)',
]
def sanitize_input(text: str) -> str:
for pattern in INJECTION_PATTERNS:
text = re.sub(pattern, '[REDACTED]', text, flags=re.IGNORECASE)
return text[:MAX_INPUT_LENGTH]
File Content Scanning
defscan_file_before_read(filepath: str) -> bool:
"""Return True if safe to read, False if suspicious."""
content = read_file(filepath)
# Check for embedded instructionsif contains_instruction_patterns(content):
returnFalse# Check for encoded payloads (base64, hex)if contains_encoded_payloads(content):
returnFalse# Check for excessively long lines (potential payload)ifany(len(line) > 10000for line in content.split('\n')):
returnFalsereturnTrue
