agentsclimarketplace

Operate agentic security tools

Skill gaelic-ghost/socket/plugins/cybersecurity-skills/skills/operate-agentic-security-tools

The Source for macOS Agent Workflows

Install
npx -y skills add gaelic-ghost/socket --skill operate-agentic-security-tools

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 6 stars6 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Operate security tools through an AI agent with explicit authority and evidence boundaries. Use when an agent may invoke local CLIs, GUI apps, browser automation, MCP servers, remote scanners, sandboxes, vulnerability tools, packet tools, or containment actions and permissions, mounts, network, secrets, approvals, logging, output, and cleanup must be constrained.

SKILL.md

2.6 KB, 420 tokens by cl100k_base, as published. Nobody here has run it

Operate Agentic Security Tools

Overview

Give the agent only the authority needed for the current security step and keep tool output reproducible. Separate discovery, active testing, exploit validation, containment, and remediation into visible decisions.

Read references/agent-tool-controls.md for the preflight record and control checklist.

Workflow

  1. Define the tool's job.

    • State the security question, expected input/output, target, and why this tool is appropriate.
    • Prefer read-only or offline operation when it can answer the question.

  2. Discover capability before use.

    • Record source, installed path or remote service, version, supported formats, privileges, network behavior, telemetry, and output location.
    • Treat missing tools or unusable integrations as results; do not invent output.

  3. Minimize authority.

    • Limit readable/writable paths, target list, network destinations, credentials, environment variables, device access, and execution duration.
    • Use temporary scoped credentials and disposable environments when credentials are unavoidable.

  4. Gate consequential actions.

    • Require an operator decision before active probing, exploit execution, persistence changes, credential access, security-control changes, destructive operations, production writes, or third-party uploads.
    • Display the exact target and likely effect before approval.

  5. Preserve evidence.

    • Record commands or UI actions, configuration, timestamps, exit status, raw output, tool errors, and transformations.
    • Validate high-impact findings with an independent observation or smallest safe reproduction.

  6. Clean up and verify.

    • Remove temporary mounts, ports, tokens, sessions, files, rules, and isolated environments.
    • Report what remains installed, running, reachable, or retained.

Guardrails

  • Do not grant broad host or cloud access merely to reduce approval prompts.
  • Do not let an agent expand active-test scope from discovered targets.
  • Do not treat an MCP server, GUI automation layer, or tool plugin as a trust boundary.
  • Do not obscure failures behind a synthesized security conclusion.

What ships with it: 2 files

957 B alongside SKILL.md

agents/

references/

Keep looking

Skills are one crate of 327,069. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.