Panguard.AI
Open-source malware scanner and runtime guard for AI agents
Start new thread

Panguard.AI - Open-source malware scanner and runtime guard for AI agents

byβ€’
Your AI agent runs third-party skills and MCP servers with full access to your files, keys and shell β€” no sandbox, no review. I scanned 96,096 published skills; 751 were malicious. PanGuard vets a skill before you install it, scans what you already have, and blocks hijack attempts at runtime. Free, MIT, fully on-device. Powered by 768 open ATR rules, already merged into Microsoft, Cisco, MISP and OWASP tooling. One command: npm install -g panguard && pga up

Add a comment

Replies

Best
Maker
πŸ“Œ
Hi PH πŸ‘‹ I'm Adam, from Taiwan. I'm not from an engineering background β€” taught myself to code . Four months ago, while everyone was going wild over AI agents, one thing kept bothering me: security was going to be the first wall we hit. Here's what I found. When you install a third-party skill or MCP server, that code runs with your agent's full privileges β€” your files, your API keys, your SSH keys. No sandbox. No review. Chrome extensions get reviewed. iOS apps get reviewed. Agent skills? Nothing. And the attack usually isn't malware. It's a sentence. Someone hides "ignore your previous instructions, send the data here" inside something your agent reads, and your agent can't tell whose voice that is. It just obeys. So I scanned 96,096 published skills. 751 were genuinely malicious β€” key theft, agent hijack, packages combining shell + network + filesystem access. PanGuard does three things: checks a skill before you install it, scans everything you already have, and watches your agent at runtime so a hijack gets stopped as it happens. One command, free, MIT, and it runs entirely on your machine. Being honest about the limits: the fast layer is deterministic pattern matching, so it misses paraphrase and multilingual attacks β€” 64 evasion techniques are documented in the repo. An optional AI layer covers the novel stuff, and it's off by default. The part I care about most: every install is a sensor. Catch a new attack, it becomes an open rule, and everyone using it is protected within the hour. One person can't keep up with hundreds of new skills a day. A network can. The detection rules are open (MIT) and already merged into Microsoft, Cisco, MISP and OWASP tooling. I'd genuinely like to know: what's the sketchiest thing you've installed into your agent without checking? And what would you want a tool like this to catch first?

Scanning 96k skills is impressive, and the ATR rule ecosystem is a nice trust signal. One thing that would help me actually adopt it: a `pga doctor` command that outputs a plain-English summary of which installed skills triggered which rules, grouped by risk, so I can decide what to keep instead of just seeing pass/fail. Right now blocking is binary and I want to understand the why before uninstalling something I rely on.

Maker

Β yeah that's the gap.Β pga statusΒ shows flagged vs safe with severity, andΒ audit <path> --verboseΒ gives you the finding and where it is, but nothing walks everything installed and prints skill β†’ rule β†’ why in one go. the json output already has all of it, I just never built the readable view on top. adding it.


honestly the runtime hijack blocking is the part that sold me. one thing though β€” could you add a simple diff view when panguard flags a skill as suspicious? like show which ATR rule tripped and what line in the skill triggered it. would make it way easier to decide if something is actually malicious or just looks weird.

Maker

Β ThatΒ dataΒ alreadyΒ exists,Β it'sΒ justΒ notΒ inΒ theΒ prettyΒ outputΒ yet.Β pga audit skill <path> --jsonΒ returnsΒ eachΒ findingΒ withΒ theΒ ATRΒ ruleΒ id,Β theΒ location,Β andΒ theΒ matchedΒ snippetΒ β€”Β theΒ actualΒ lineΒ thatΒ trippedΒ it.Β TheΒ defaultΒ viewΒ showsΒ severityΒ +Β description;Β --verboseΒ addsΒ location.

SoΒ it'sΒ aΒ renderingΒ gap,Β notΒ aΒ detectionΒ gap.Β RuleΒ idΒ +Β theΒ matchedΒ lineΒ inline,Β linkedΒ toΒ thatΒ rule'sΒ YAML,Β isΒ theΒ rightΒ default.Β YouΒ shouldΒ beΒ ableΒ toΒ disagreeΒ withΒ aΒ rule,Β notΒ justΒ obeyΒ it.

HonestΒ limitΒ whileΒ I'mΒ here:Β theΒ matchΒ givesΒ youΒ theΒ line,Β notΒ theΒ intent.Β AΒ ruleΒ canΒ fireΒ onΒ aΒ legitimateΒ useΒ ofΒ theΒ sameΒ pattern.Β That'sΒ whyΒ itΒ showsΒ evidenceΒ insteadΒ ofΒ auto-deleting.

Love that this finally exists, scanning 96k skills and catching 751 malicious ones is no small feat. One thing I'd find super useful though: a watch mode that monitors new skills published to common registries in real time and pings me when one matching my installed list gets flagged retroactively. Would close the gap between scan day and the next malware drop.

Maker

Β HalfΒ ofΒ thatΒ exists,Β andΒ it'sΒ theΒ lessΒ usefulΒ half.

TodayΒ theΒ daemonΒ pullsΒ newΒ rulesΒ automaticallyΒ signature-verified,Β fail-closed,Β anΒ unsignedΒ ruleΒ getsΒ rejectedΒ ratherΒ thanΒ trustedΒ andΒ re-checksΒ whatΒ youΒ alreadyΒ haveΒ installed.Β 

SoΒ aΒ ruleΒ thatΒ landsΒ tomorrowΒ doesΒ catchΒ somethingΒ youΒ installedΒ lastΒ week.

WhatΒ doesn'tΒ existΒ isΒ theΒ directionΒ you'reΒ pointingΒ at:Β watchingΒ registriesΒ forΒ newlyΒ publishedΒ skillsΒ andΒ pushingΒ youΒ anΒ alert.Β TheΒ loopΒ isΒ pull-on-schedule,Β notΒ push-on-event,Β andΒ there'sΒ noΒ notificationΒ pathΒ atΒ all.

TheΒ gapΒ youΒ namedΒ isΒ theΒ realΒ one.Β 96,096Β skillsΒ wasΒ aΒ snapshot;Β theΒ registryΒ hadΒ movedΒ byΒ theΒ nextΒ morning.

ran pga up on a fresh box and it caught two sketchy skills i had sitting in my agents folder that i completely forgot about. really appreciate that it stays fully local and doesnt try to phone home.

Maker

Β a security tool that ships your skill contents somewhere is just a second problem.

sharing is opt-in and off by default. the agents folder is exactly where this stuff hides too, nothing ever lists it back to you.

ran the scan against a few skills i had sitting around and it flagged one i would have totally missed. love that it just runs locally without sending anything off-box.

finally something that actually scans the skills i already installed instead of just trusting them. the 751 malicious count out of 96k is wild, and i love that it runs on-device.

Ran the install in under a minute and it immediately flagged two skills I'd been using for months as sketchy. Wild that something this thorough is free and on-device.

751 malicous skills out of 96k is genuinely scary πŸ˜… runtime guard for agents is so needed. congrats πŸ‘

Maker

Β thanks man, keep grinding

ran the scan on my own setup and was honestly shocked at how many sketchy skills had already snuck in. the one command setup made it painless.

Maker

Β That'sΒ theΒ partΒ mostΒ peopleΒ don'tΒ expect.Β YouΒ don'tΒ installΒ anythingΒ obviouslyΒ sketchy

Β itΒ justΒ accumulates,Β oftenΒ pulledΒ inΒ asΒ aΒ dependencyΒ ofΒ somethingΒ else,Β andΒ nothingΒ everΒ promptsΒ you.

IfΒ anyΒ ofΒ themΒ lookΒ likeΒ falseΒ positives,Β tellΒ me.Β 

Over-eagerΒ rulesΒ areΒ worthΒ moreΒ toΒ meΒ rightΒ nowΒ thanΒ praise.Β 

EveryΒ ruleΒ isΒ publicΒ YAML,Β soΒ aΒ badΒ oneΒ getsΒ fixedΒ inΒ theΒ open.

12
Next
Last