agent-security-review

# agent-security-review Adversarial review of an **agent's configuration + behaviour** — the trust anchor, not the app code. Where [`threat-modeling`](../threat-modeling/SKILL.md) models a code change and [`security-audit`](../security-audit/SKILL.md) hunts code vulns, this asks: given this assembled config (rules, skills, MCP, hooks, permissions, memory), how would an attacker turn it against its owner, and what gap lets them? Pairs the static signal from `/security-audit-config` with a three-lens adversarial pass. Output is **decision support** — surface the trade-off, name the gap; the human decides. ## When to use - "Is my agent setup safe / could this be weaponised". - Before trusting a third-party skill pack, MCP server, or rules file. - Periodic posture review of a fleet's agent config. - Any `D`/`F` category from `/security-audit-config` needing depth. ## Procedure ### 1. Inventory + inspect the attack surface Inspect the config the agent loads and check each surface: instruction files (CLAUDE.md / AGENTS.md / .cursor/rules / copilot-instructions), installed skills + their `allowed-tools`, MCP servers + tool descriptions, hooks + lifecycle scripts, permission/auto-approve settings, persistent memory, **and CI workflows running an AI agent** (`.github/workflows/*` invoking an agent action or CLI: check trigger — `pull_request_target` on fork PRs is attacker-influenced —, `permissions:` grants, secrets exposure, whether PR title/body/diff flow into the agent's pr...