| name | medusa-security |
| description | AI-first security scanning with Medusa. 3,000+ detection patterns covering AI/ML, agents, MCP, RAG, prompt injection, and traditional SAST vulnerabilities. Wraps Medusa CLI with SARIF/JSON parsing, structured finding output, OWASP mapping, and remediation guidance. |
| version | 1.1.0 |
| category | security |
| model | sonnet |
| invoked_by | agent |
| user_invocable | true |
| tools | ["Read","Write","Edit","Bash","Glob","Grep"] |
| agents | ["security-architect","penetration-tester","code-reviewer"] |
| tags | ["security","sast","ai-security","mcp-security","prompt-injection","vulnerability-scanning"] |
| best_practices | ["Run full scan before release for comprehensive coverage","Use ai-only mode for rapid AI/LLM-focused checks","Use quick mode during development for changed-files-only scanning","Always review CRITICAL and HIGH findings before deployment","Use --fail-on high in CI/CD pipelines"] |
| error_handling | graceful |
| streaming | supported |
| verified | true |
| lastVerifiedAt | "2026-02-22T00:00:00.000Z" |
| source | builtin |
| trust_score | 100 |
| provenance_sha | d1460c3e9767a2db |
Medusa Security Skill
Identity
AI-first security scanner integration skill. Leverages Medusa's 76 scanners and 3,000+ detection
patterns for comprehensive security analysis including AI/ML-specific vulnerability detection.
Capabilities
- Full Scan — All 76 scanners, comprehensive security analysis
- AI-Only Scan — Prompt injection, MCP security, agent security, RAG security
- Quick Scan — Git-changed files only for rapid development feedback
- Targeted Scan — Specific scanner categories (mcp, secrets, prompt-injection, etc.)
- SARIF Output Parsing — Standard SARIF v2.1.0 structured findings
- JSON Output Parsing — Medusa-native JSON format
- OWASP Mapping — Maps findings to OWASP Agentic AI (ASI01-10) and OWASP Top 10 (A01-10)
- Remediation Guidance — Links findings to agent-studio skills and agents
- CI/CD Integration — Fail-on thresholds, SARIF upload for GitHub Code Scanning
Prerequisites
Python 3.10+
pip install medusa-security
Check installation: python -m medusa --version
Workflow: Full Security Scan
python -m medusa --version
medusa scan . --format sarif --fail-on high
node .claude/skills/medusa-security/scripts/main.cjs --mode full --target .
Workflow: AI-Only Scan
medusa scan . --format sarif --ai-only
Scans only: prompt injection (800+ patterns), MCP security (400+ patterns), agent security
(500+ patterns), RAG security (300+ patterns).
Workflow: Quick Scan (Development)
medusa scan . --format sarif --quick
Only scans git-changed files. Use during development for rapid feedback.
Workflow: Targeted Scan
medusa scan . --format sarif --scanners mcp-server,mcp-config
medusa scan . --format sarif --scanners secrets,gitleaks,
medusa scan . --format sarif --scanners ai-context
