trustmyagent

🛡️ TrustMyAgent - Security posture monitoring for AI agents. Runs 41 stateless checks across 14 domains and calculates a trust score (0-100). Supports local-only mode (no network calls) and dry-run mode (preview before sending).

Ir a la instalación

Repositorio: Anecdotes-Yair/trust-my-agent-ai
Última actividad en el origen: 26 de febrero de 2026 a las 09:52
Idioma detectado de SKILL.md: inglés
Estrellas: 7
Forks: 1

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/Anecdotes-Yair/trust-my-agent-ai --skill trustmyagent

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

name	trustmyagent
description	🛡️ TrustMyAgent - Security posture monitoring for AI agents. Runs 41 stateless checks across 14 domains and calculates a trust score (0-100). Supports local-only mode (no network calls) and dry-run mode (preview before sending).
version	1
author	Anecdotes AI Labs
license	MIT
homepage	https://www.trustmyagent.ai
repository	https://github.com/Anecdotes-Yair/trust-my-agent-ai
metadata	{"openclaw":{"emoji":"🛡️","category":"security","tags":["security","compliance","monitoring","trust"],"requires":{"bins":"[Truncated]"},"shared":true,"install":["[Truncated]","[Truncated]"]}}

🛡️ TrustMyAgent - Security Agent

Stateless security posture monitoring for AI agents.

TrustMyAgent runs 41 read-only security checks across 14 domains on the host machine, calculates a trust score (0-100), and optionally reports results to a public Trust Center dashboard. It is fully stateless — no files are written, no state is persisted, and no background processes are installed without explicit user consent.

Open source: All check logic is visible in run.py and checks/*.json. The full source code is at github.com/Anecdotes-Yair/trust-my-agent-ai.

Setup

When the user asks to set up TrustMyAgent, walk them through the following steps. Present each step to the user and wait for their approval before executing. Do not run commands silently or skip user confirmation.

Step 1: Verify Python 3

Check that Python 3 is available:

python3 --version

If Python 3 is not installed, ask the user before installing it:

macOS: brew install python3
Linux: sudo apt-get install python3 or sudo apk add python3

Step 2: Run a dry-run assessment

Run the security assessment in dry-run mode first so the user can review the results before any data leaves the machine:

python3 {baseDir}/run.py --dry-run

This runs all 41 checks and prints the full telemetry payload that would be sent — but sends nothing. Show the user the results and let them review:

The trust score and tier
Which checks passed and failed
The exact JSON payload that would be transmitted

Ask the user: "Would you like to send this report to the Trust Center dashboard, run in local-only mode (no network), or adjust any settings?"

Step 3: Run the full assessment (with user consent)

If the user approves sending telemetry:

python3 {baseDir}/run.py

If the user prefers local-only mode (no telemetry sent):

python3 {baseDir}/run.py --local-only

Step 4: Schedule recurring assessments (optional)

Ask the user if they want to schedule automatic assessments. If they agree, suggest a cron job. The command varies by agent platform:

Field	Example	Purpose
`agent.id`	`sha256(hostname)`	Unique identifier (derived from hostname hash, not the hostname itself)
`agent.name`	`"My Agent"`	Display name (from IDENTITY.md or env var)
`agent.platform`	`"darwin"`	OS type (darwin/linux)
`agent.detected_env`	`"macos_arm64"`	Runtime environment label
`posture.trust_tier`	`"HIGH"`	Computed trust tier
`posture.overall_score`	`92`	Numeric score 0-100
`results[]`	`{check_id, passed, status}`	Per-check pass/fail status
`detections[]`	`{check_id, severity, risk}`	Failed checks with risk context

Domain	Checks	Focus
Physical Environment	PHY-001 to PHY-005	Disk encryption, container isolation, non-root execution
Network	NET-001 to NET-005	Dangerous ports, TLS/SSL, DNS, certificates
Secrets	SEC-001 to SEC-005, MSG-005	Env var secrets, cloud creds, private keys, conversation leaks
Code	COD-001 to COD-004	Git security, no secrets in repos
Logs	LOG-001 to LOG-004	System logging, audit readiness
Skills	SKL-001 to SKL-005, MSG-001, MSG-003	Skill manifests, MCP server trust
Integrity	INT-001 to INT-005, MSG-002, MSG-006	Backdoors, browser abuse, suspicious tool calls, URL reputation
Social Guards	SOC-001 to SOC-006, MSG-004	Action logging, session transparency, Moltbook integrity, owner reputation
Incident Prevention	INC-001 to INC-005	Process spawning, system load, port scanning
Node Security	NODE-001 to NODE-005	Remote execution approval, token permissions, exec allowlists
Media Security	MEDIA-002 to MEDIA-003	Temp directory permissions, file type validation
Gateway Security	GATEWAY-001 to GATEWAY-002	Binding address, authentication
Identity Security	IDENTITY-001 to IDENTITY-002	DM pairing allowlist, group chat allowlist
SubAgent Security	SUBAGENT-001 to SUBAGENT-002	Concurrency limits, target allowlists

Tier	Score	Label
HIGH	90-100	Ready for Business
MEDIUM	70-89	Needs Review
LOW	50-69	Elevated Risk
UNTRUSTED	0-49	Critical Security Gaps

Flag	Description
`--checks`, `-c`	Path to custom checks JSON file
`--timeout`, `-t`	Timeout per check in seconds (default: 30)
`--quiet`, `-q`	Minimal output
`--json`, `-j`	Output structured JSON to stdout
`--dry-run`	Run all checks and display the telemetry payload, but do not send it
`--local-only`	Run all checks locally without any network calls
`--no-notify`	Skip agent notifications for detections

Source	Description	Default
`IDENTITY.md`	Agent display name (read from `# Name` section)	`"Agent"`
`OPENCLAW_AGENT_NAME` env var	Overrides IDENTITY.md name	—
`OPENCLAW_AGENT_ID` env var	Agent identifier	SHA256 of hostname
`TRUSTMYAGENT_TELEMETRY_URL` env var	Server endpoint	`https://www.trustmyagent.ai/api/telemetry`

trustmyagent

Opciones de instalación

Revisa los archivos de origen

🛡️ TrustMyAgent - Security Agent

Setup

Step 1: Verify Python 3

Step 2: Run a dry-run assessment

Step 3: Run the full assessment (with user consent)

Step 4: Schedule recurring assessments (optional)

🛡️ TrustMyAgent - Security Agent

Setup

Step 1: Verify Python 3

Step 2: Run a dry-run assessment

Step 3: Run the full assessment (with user consent)

Step 4: Schedule recurring assessments (optional)

What Data Is Sent

Opting out of telemetry

How It Works

Security Domains

Check Types

Bash checks (20 checks)

Python/Message-based checks (21 checks)

Platform Support

Trust Tiers

Command Line Options

Configuration

Files

Architecture

Privacy & Trust

Credits

trustmyagent

Datos de origen

Opciones de instalación

Revisa los archivos de origen

🛡️ TrustMyAgent - Security Agent

Setup

Step 1: Verify Python 3

Step 2: Run a dry-run assessment

Step 3: Run the full assessment (with user consent)

Step 4: Schedule recurring assessments (optional)

🛡️ TrustMyAgent - Security Agent

Setup

Step 1: Verify Python 3

Step 2: Run a dry-run assessment

Step 3: Run the full assessment (with user consent)

Step 4: Schedule recurring assessments (optional)

What Data Is Sent

Opting out of telemetry

How It Works

Security Domains

Check Types

Bash checks (20 checks)

Python/Message-based checks (21 checks)

Platform Support

Trust Tiers

Command Line Options

Configuration

Files

Architecture

Privacy & Trust

Credits