Capability
Agent Governance
Agents that can read files, run shell commands, and call external APIs need documented boundaries.
CRITICAL
Permission bypass in marketplace.json — connector scope exceeds declared capabilities
21%
critical repos have excessive agency
CHK-125
excessive agency checker
CHK-124
rug pull / description drift
Capability
The server you approved is not the server running today.
CHK-124 hashes every tool description at scan time. On rescan, any change fires a rug pull alert with a full diff. The server approved last Tuesday may have been updated silently since.
Description hash compared on every rescan
Any change fires CHK-124 — single word diff is enough
Full diff shown in Alerts tab
NDJSON event dispatched to SIEM on every alert
How it works
01
Connect your GitHub org
OAuth in 30 seconds. AISS discovers every MCP server, skill file, hook, and agent config across all repos.
02
22 modules scan in parallel
CVE lookup, secret scanning, auth checking, tool description analysis, skill file parsing — all concurrent, all hand-written.
03
LLM verifies high-severity
Critical and high findings go to an LLM verifier before reporting. No false positives reach your CISO.
04
Gate, alert, or export
Block in CI via SARIF. Send to SIEM via NDJSON. Export CycloneDX SBOM. Enforce allowlist/blocklist policy.
Press coverage
VentureBeat
Anthropic Skill scanners passed every check. The malicious code rode in on a test file.
VentureBeat
No publicly documented scanner operates outside the assumption that the threat lives in SKILL.md.
CrowdStrike · RSAC 2026
ClawHavoc — 1,184 malicious skills confirmed in the wild. The attack surface is the skill layer.