SIQ Agent Security skill
A skill and local program for agent safety: inventory, skill admission checks, human-approved grants and signed receipts.
- 50 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- The skill calls a local program that reads agent configurations and manages grants and host hooks.
- A hook mistake can block legitimate agent operations or leave paths unchecked.
Install
- Works in
Manual install
git clone https://github.com/maoyadongsh/siq-agent-security.gitBuild from sources for the personal console, then `siq-agent-security start --port 47611`.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The skill calls a local program that reads agent configurations and manages grants and host hooks.
- A hook mistake can block legitimate agent operations or leave paths unchecked.
This is third-party code. Review the repository files before installing.
What it does
SIQ Agent Security helps manage agent safety on your own machine. The `siq-agent-security` skill only guides the operator: it installs and calls the local program, shows the skill admission verdict unchanged and opens the personal console. Decisions come from the program and not the model: the model neither judges safety nor approves grants. The Go program inventories agents, skills and MCP servers, checks candidate skills before installation, stores grants given by a human and signs receipts for calls on integrated execution paths. Signatures use Ed25519 and SHA-256 digests. The personal console runs in a browser with a pairing code, and an enterprise part with a control plane also exists. Adapters target Hermes, OpenClaw and WorkBuddy.
Who it is for. People running several agents and skills on one machine who want to see each rights and actions, and security teams in an organisation.
Good fit when
- A skill from a hub, a git link or a USB stick must be checked before installation
- You want to see which agents, skills and MCP servers are installed on the machine
- A skill should be limited to read or write in one folder
- After a run you need signed records of what exactly was called
- An organisation needs a shared panel over agents with role separation
Not a fit when
- You need OS-level isolation: the author states desktop mode does not stop a malicious process of the same user
- You work in Claude Code or Cursor: the README has adapters only for Hermes, OpenClaw and WorkBuddy
- A simple skill list without rights and audit is enough
Example request
Check this skill before installing, show the verdict and Skill Card unchanged and open my personal console.Limitations
Installing the skill alone does not enable protection: you need the local program running and host hooks connected. Checks apply only on correctly integrated execution paths, and some terminal, execute_code, delegation and MCP paths are rejected wholesale when effects are unknown, so legitimate operations are sometimes blocked. Desktop mode does not isolate processes of the same user. Building from source needs Go 1.26.6 and Node.js 22, the enterprise part needs PostgreSQL, and the signed 0.4.1 package is easier. The repository is large, about 200 MB. Research findings come from small sets and are not a security certification.
How to disable. Stop the local program, delete the skill from the agent directory and the host hooks from its configuration. Delete the state directory (default `~/.local/state/siq-agent-security`) with keys and logs separately.
FAQ
How do I install SIQ Agent Security?
The best route is the signed 0.4.1 package from the releases page with signature verification per `docs/signed-release-packaging.md`. Sources build with Go 1.26.6 and Node.js 22 and then start with `siq-agent-security start --port 47611`.
Does installing the skill alone protect me?
No. The skill only gives guidance. Protection works when the local program runs and host hooks are loaded, which you confirm by behaviour.
Who grants rights to a skill?
Only a human through the personal console. The skill explicitly forbids the model from calling `grant approve` and shows the admission verdict unchanged.
Which agents are supported?
Adapters are described for Hermes, OpenClaw and WorkBuddy on macOS and Windows, with Linux and WorkBuddy excluded. The README lists no adapters for Claude Code or Cursor.
Can I try it without a model?
Yes. `scripts/hackathon/start.sh --mode test --port 47621` starts a demo without model keys, needing Git, Go, Python 3.12 or newer and Node.js 22.
Discussion
No questions or reviews yet.
Related
SkillsA CLI that scans your machine for skills and MCP configs, finds poisoned tool descriptions and runs a system prompt through 225 attacks
A security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
AgentGuard checks a coding agent's actions before they run and scans third-party skills for secrets, backdoors and injections.
An OpenClaw skill that audits the agent itself: 230 checks, change watching and an A to F grade.
Security scanner for agent skills and MCP servers: finds prompt injection, data exfiltration and supply chain risks before install
Cybersecurity Skills
Cybersecurity Skills for AI Agents
42 security skills for Claude Code, Cursor and Codex: code and cloud audits, authorization-gated pentesting and incident response
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| SIQ Agent Security (this card) | no | 50 | |
| AgentGuard | no | 494 | checks coding agent actions and scans skills; SIQ adds human-approved grants and signed receipts |
| Skill Scanner | no | 2,724 | scans skills for malicious content; SIQ manages rights and audit on the machine |
README in short
The README in Chinese and English sets out the architecture of a local program, host hooks and an enterprise panel, two routes for personal and enterprise use, research results and security limits.
README badge
Original SKILL.md
---
name: siq-agent-security
description: Manages local agent security and browser connections.
version: 0.2.0
license: Apache-2.0
author: SIQ Agent Security
allowed-tools: terminal read_file
compatibility: Linux, macOS, and Windows. L3 OpenShell requires Linux or Docker/WSL2.
metadata:
hermes:
tags: security, admission, skills
category: security
---
# siq-agent-security Skill
Provides operating guidance for the local `siq-agent-security` runtime. The
runtime inventories assets, admits candidate Skills, manages human-approved
grants, and signs receipts for calls on integrated execution paths. Installing
this Skill alone does not install host hooks or establish effective protection.
You (the model) do not judge whether a skill is safe. Run
`siq-agent-security admit` and present the `verdict` and Skill Card unchanged.
You must not call `siq-agent-security grant approve`.
## When to Use
- The user asks to install, review, or "check" a skill from a hub, git URL,
USB copy, or chat upload.
- The user wants a runtime gate on OpenClaw or Hermes, or WorkBuddy on
macOS/Windows. Linux/WorkBuddy is excluded.
- The user asks what agents, skills, or MCP servers are on this machine.
- The user asks to open their personal console, reconnect it, or explicitly
supplies a browser connection request ID from that console.
Do not use this skill to answer business questions. Do not approve grants.
## Prerequisites
- A writable state directory (default: `~/.local/state/siq-agent-security` on
Linux, `~/Library/Application Support/siq-agent-security` on macOS,
`%LOCALAPPDATA%\siq-agent-security` on Windows).
- For L2: an in-scope host with its configured hook actually loaded; check
the platform readback and behavior evidence, not just installation success.
- For L3: a running NVIDIA OpenShell gateway on Linux, or Docker/WSL2 elsewhere.