Scanners-Box 每日 AI 工具推荐 Scanners-Box Daily AI Tool Picks 面向极客、企业与 AI 智能体的全域开源网络安全工具矩阵 The Ultimate Open-Source Security Arsenal for Hackers, Enterprises, and AI Agents GitHub 仓库 View on GitHub

每天一个值得关注的 AI 安全 / 效率工具，重实用、可落地。 One AI security / productivity tool per day — practical and ready to use.

025 收录工具Tools
18.4万184.3k 收录项目 star 总量Total GitHub stars
10 覆盖分类Categories
2026-11-02 最近更新Last update
今日已更新Updated today
订阅Subscribe

2026

第 025 期 No. 25

AICGSecEval (A.S.E) AICGSecEval (A.S.E) AICGSecEval (A.S.E) GitHub stars AI-Generated Code Security Evaluation

项目级 AI 代码安全评测基准：145 道真实 CVE 填空题，51 个 GitHub 仓库，AI 在项目上下文中补代码，动静态双轨判定——SAST 扫一遍、PoC 打一遍——看漏洞是不是被原样写了回来 Repository-level AI code security benchmark: 145 real-CVE fill-in-the-blank questions across 51 GitHub repos — AI completes code within project context, then static SAST + dynamic PoC dual-track verdict checks whether vulnerabilities were written back verbatim

腾讯悟空代码安全团队联合复旦/北大/上交/清华/浙大五校共建。v2.0 三大升级：数据集覆盖 OWASP Top 10 + CWE Top 25 共 29 种 CWE（C/PHP/Java/Python/JS 五语言 145 实例）；新增 Agentic 编程工具评测（Claude Code 等 agent 可插件化接入）；动静态协同评估（SAST Docker 镜像扫描 + 容器内功能测试/PoC 验证）。读码发现：评测对象不是模型而是「模型+项目上下文」耦合；BM25 检索项目文件作为上下文，与真实开发者信息流同构；Agent 模块继承 AgentBenchBase 三方法即可扩展。短板：C+PHP 占比 77%+语言分布不均；SAST 工具仅两个镜像覆盖面有限；100GB 磁盘+Docker 硬件门槛不低。 Built by Tencent Wukong Code Security Team with five universities (Fudan/PKU/SJTU/Tsinghua/ZJU). v2.0 brings three upgrades: dataset covers OWASP Top 10 + CWE Top 25 across 29 CWE types (C/PHP/Java/Python/JS, 145 instances); Agentic coding tool evaluation (Claude Code and similar agents plug in via plugin architecture); static+dynamic collaborative assessment (SAST Docker image scanning + in-container functional tests/PoC verification). From the source: the evaluation target is the "model + project context" coupling, not the model alone; BM25 retrieves project files as context, isomorphic to real developer information flow; Agent modules extend AgentBenchBase with three methods. Gaps: C+PHP account for 77%+ (uneven language distribution); only two SAST tool images limit coverage; 100GB disk + Docker is a non-trivial hardware barrier.
https://github.com/Tencent/AICGSecEval 详细分析 → Deep dive →

第 024 期 No. 24

AIMap AIMap AIMap GitHub stars AI 基础设施攻击面发现 AI Infrastructure Attack Surface Discovery

公网 AI 服务的攻击面地图：32 条 Shodan 查询找出暴露的 MCP/Ollama/vLLM，Nuclei 验明协议与工具，0–10 风险打分，再按协议跑攻击验证 An attack-surface map for AI services on the open internet: 32 Shodan queries surface exposed MCP/Ollama/vLLM endpoints, Nuclei fingerprints protocol and tools, a 0–10 risk score ranks them, then protocol engines verify the damage

四步流水线：Shodan 发现（32 条查询 11 类协议，词库来自 Knostic/Praetorian/Cisco 等暴露面研究）→ 三路证据指纹（banner 解析 + Nuclei 模板 + 实时探测）→ 风险打分（无鉴权 +4 最大单因子，危险组合 4 种，≥9 分 critical）→ 攻击引擎（MCP 七阶段，深度四档，判定靠关键词启发式）。读码发现：200 即判无鉴权、组合检测子串匹配、截断饱和；ANTHROPIC_API_KEY 只有声明无调用，Claude 攻击推理还在 ROADMAP。 Four-stage pipeline: Shodan discovery (32 queries across 11 protocol families, sourced from Knostic/Praetorian/Cisco exposure research) → three-way fingerprinting (banner parsing + Nuclei templates + live probes) → risk scoring (no-auth is the biggest factor at +4, four dangerous combos, critical at ≥9) → attack engines (seven MCP phases, four depths, keyword-heuristic verdicts). From the source: HTTP 200 counts as no-auth, combos are substring matches, the score saturates at 10 — and ANTHROPIC_API_KEY is declared but never read; the Claude attack reasoning lives in the ROADMAP.
https://github.com/BishopFox/aimap 详细分析 → Deep dive →

第 023 期 No. 23

DeepTeam DeepTeam DeepTeam GitHub stars AI 红队测试框架与 Agent AI Red Teaming Frameworks & Agents

红队测试 + 生产护栏两半都包：一个 LLM 现写攻击、一个 LLM 判定、失败带 CVSS；测出来的偏见/PII/提示注入，线上挂 7 个守卫直接拦 Red teaming and production guardrails in one framework: one LLM writes the attacks, another judges each case, failures carry CVSS — and the bias/PII/prompt injection the tests surface get blocked live by 7 guards

36 类 251 型漏洞面（Agentic 占 11 类），22 种单轮 + 5 种多轮攻击（Crescendo/Linear/Tree/Sequential/BadLikertJudge）。callback 契约把 retrieval_context 和 tools_called 交给裁判，RAG 投毒与工具滥用才测得出来。读码三个坑：拒答即过（16 前缀 + 24 标记，仅英文，中文拒答会被误判）；risks.py 只映射 19 个类型族，Agentic 全落 Others；CVSS 的 impact 恒为 MEDIUM（源码注释承认未按漏洞类型推导）。护栏 7 个（输入/输出两侧挂守卫），LLM 判定 safe/borderline/unsafe，任一守卫非明确 safe 即 breached、出错按 unsafe（fail-closed），sample_rate 降采样控成本。默认 ignore_errors=True、自动上传 Confident AI 并开浏览器。 36 classes / 251 vulnerability types (11 in Agentic), 22 single-turn plus 5 multi-turn attacks (Crescendo/Linear/Tree/Sequential/BadLikertJudge). The callback contract hands retrieval_context and tools_called to the judge, which is what makes RAG poisoning and tool abuse testable at all. Three gotchas from the source: refusals auto-pass (16 prefixes + 24 markers, English-only — Chinese refusals get mis-scored); risks.py maps only 19 type families and all Agentic types land in Others; CVSS impact is always MEDIUM (a source comment admits it is not yet derived from the vulnerability type). Guardrails: 7 guards on inputs and outputs, LLM verdicts safe/borderline/unsafe, any guard not explicitly safe sets breached, guard errors count as unsafe (fail-closed), sample_rate sampling to control cost. Defaults: ignore_errors=True and auto-upload to Confident AI with a browser popup.
https://github.com/confident-ai/deepteam 详细分析 → Deep dive →

第 022 期 No. 22

OWASP AISVS OWASP AISVS OWASP AISVS GitHub stars AI 安全验证标准与规范 AI Security Verification Standards

不是又一份 AI 风险 Top 10：它把训练数据、RAG 记忆、Agent 与 MCP 拆成 213 条可验证要求，告诉团队具体该做什么、做完怎么验 Not another AI-risk Top 10: 213 testable requirements across training data, RAG memory, agents and MCP — turning security principles into reviewable, testable engineering objects

1.01 已锁定，1.02 开发中；12 章 213 条核心要求，L1/L2/L3 为 57/110/46。重点是跨章节联防：C2 输入检测 + C10 MCP 输出筛查 + C9 确定性授权；Agent 审批从展示完整参数走到密码学绑定动作对象；RAG 记忆要有租户边界、写入检疫、过期与审计。短板：没有官方扫描器，幻觉/投毒等判定器本身仍不可靠，部分条款需按输入类型裁剪；不替代 ASVS、NIST AI RMF 或威胁建模。 Stable 1.01 is locked while 1.02 is in development: 213 core requirements across 12 chapters, with L1/L2/L3 at 57/110/46. Its strength is cross-chapter defense: C2 input screening + C10 MCP response validation + C9 deterministic authorization. Agent approval progresses from complete parameter display to cryptographic binding with the action object; RAG memory gets tenant boundaries, write quarantine, expiry and audit. Caveats: no official scanner, imperfect oracles for hallucination and poisoning, and some requirements need careful scoping. It does not replace ASVS, NIST AI RMF or threat modeling.
https://github.com/OWASP/AISVS 详细分析 → Deep dive →

第 021 期 No. 21

mcp-scanner mcp-scanner mcp-scanner GitHub stars AI 基础设施攻击面发现 AI Infrastructure Attack Surface Discovery

Cisco 开源的 MCP 服务器安检：YARA + LLM + AI Defense 三引擎并联，共 9 个分析器；最值钱的是报告纪律——扫描没跑完 is_safe 返回 None，不许说安全 Cisco's open-source security screening for MCP servers — YARA + LLM + AI Defense in parallel, nine analyzers; the real prize is the reporting discipline: an unfinished scan returns is_safe=None, never "safe"

MCP 能投毒的四张面（工具描述 / prompts / resources / server instructions）逐个开入口，known-configs 直接扫本机 Cursor、Claude、VS Code 配置。YARA 的 10 个规则文件跑在描述文本上不是二进制，规则注释里留着误报修复记录；behavioral 用 tree-sitter 建 CFG 和跨文件调用图比 docstring 与实现，10 种语言，evals 141 个自造恶意样本 95.7% 但良性只有 3 个文件。is_safe 三值（result.py:88），汇总分 safe/unsafe/incomplete 三桶；分析器异常只留类名进 analyzer_errors，status 降 partial；REST API 对响应形状会丢 finding 的分析器直接 422。短板：零 key 路径全读描述不碰代码，readiness 的 opa 没装静默跳过、LLM judge 失败只 warning，prompt_defense 的 README 与代码不符（要显式开启）。 Every poisonable surface of MCP (tool descriptions / prompts / resources / server instructions) gets its own entry point, and known-configs scans your local Cursor, Claude and VS Code configs directly. The 10 YARA rule files run over description text, not binaries, with false-positive fixes kept in the rule comments; behavioral builds CFGs and cross-file call graphs with tree-sitter to compare docstrings against implementations across 10 languages — 95.7% on 141 self-authored malicious samples, but only 3 benign files. is_safe is three-valued (result.py:88) and results bucket into safe/unsafe/incomplete; analyzer exceptions keep only the class name in analyzer_errors and drop status to partial; the REST API answers 422 for analyzers whose findings its response shape would drop. Caveats: the zero-key path reads descriptions without touching code, readiness silently skips Rego when opa is missing and only warns on LLM judge failure, and prompt_defense's README contradicts the code (it needs an explicit flag).
https://github.com/cisco-ai-defense/mcp-scanner 详细分析 → Deep dive →

第 020 期 No. 20

agent-sandbox agent-sandbox agent-sandbox GitHub stars AI 智能体运行时管控 AI Agent Runtime Controls

Kubernetes SIG Apps 官方出品：把「一个长期活着、有稳定名字、带自己磁盘的单容器」补成 Sandbox 这层 API，隔离一行代码都不自己写，全交给 gVisor / Kata Official Kubernetes SIG Apps project: turns "one long-lived container with a stable name and its own disk" into a first-class API — and writes zero isolation code itself, delegating it all to gVisor / Kata

控制面与数据面拆得很干净：控制器只管生命周期，HTTP 走 sandbox-router（X-Sandbox-* 头契约），进程执行走 sandboxd 的 gRPC。休眠不是 checkpoint——置 Suspended 只删 Pod、留住 PVC，唤醒重挂同一块盘，内存态必丢。热池申领是「改归属」不是「建 Pod」，ownerRef 一换就到手，所以能压到百毫秒；但 claim 里写了 env 或 volumeClaimTemplates 会静默退化成冷启动。默认值偏保守：不挂 ServiceAccount token、NetworkPolicy 封 RFC1918 和 metadata。短板在时间——自动挂起/按流量唤醒、scale-to-zero、模板滚动更新、MCP server、TS SDK 全挂在 roadmap，API 还是 v1beta1 且不承诺兼容。 The control and data planes are cleanly split: the controller only owns lifecycle, HTTP goes through sandbox-router (the X-Sandbox-* header contract), process execution through sandboxd's gRPC. Hibernation is not a checkpoint — setting Suspended deletes the Pod and keeps the PVC, so the wake reattaches the same disk and loses all memory state. Claiming from a warm pool is an ownership reassignment, not a Pod creation — one ownerRef swap, hence sub-second claims; but putting env or volumeClaimTemplates in the claim silently degrades it to a cold start. Defaults are conservative: no ServiceAccount token, NetworkPolicy blocks RFC1918 and the metadata endpoint. The weak point is time — auto-suspend, traffic-triggered resume, scale-to-zero, template rollouts, the MCP server and the TS SDK are all still roadmap, the API is still v1beta1, and compatibility isn't promised.
https://github.com/kubernetes-sigs/agent-sandbox 详细分析 → Deep dive →

第 019 期 No. 19

h5i h5i h5i GitHub stars Agent 工作流安全工具箱 Security Toolkits for Agentic Workflows

把 Burp 那一层重做成 Agent 原生工作台：浏览器驱动 + 抓包改包重放 + 沙箱 box + Lean 4 形式化验证，纪律条款编译进二进制 The Burp layer rebuilt as an agent-native workbench — browser driving, HTTP capture/tamper/replay, sandbox boxes and Lean 4 proofs, with the discipline compiled into the binary

Rust 写的双轨项目：红队侧给 agent 一套统一原语（browser / websec / recon / box / app），证明侧用 h5i-app 把纯函数 kernel 经 Aeneas 翻成 Lean 4。最值钱的是那份 include_str! 编进可执行文件的 SKILL.md —— message id 当证据链的 join 键、「No complete PoC, no vulnerability」、「denial 是策略结果不是障碍」、禁止在 box 里关 hook。短板：概念密度高没有 GUI、证明侧只覆盖自家框架、插件不装等于回路跑不通、macOS 借道 Chromium 时 --ignore-https-errors。 A two-track Rust project: the red-team leg gives an agent one set of primitives (browser / websec / recon / box / app); the proof leg extracts a pure-function h5i-app kernel through Aeneas into Lean 4. The most valuable part is the SKILL.md embedded in the executable via include_str! — message ids as the evidence-chain join key, "No complete PoC, no vulnerability", "a denial is a policy result, not an obstacle", never disable a hook inside a box. Caveats: concept-dense with no GUI, the proof side covers only its own framework, skipping the plugins breaks most of the loop, and macOS Chromium proxying uses --ignore-https-errors.
https://github.com/h5i-dev/h5i 详细分析 → Deep dive →

第 018 期 No. 18

LLMFuzzer LLMFuzzer LLMFuzzer GitHub stars AI 智能体与应用安全审计 Security Auditing for AI Agents & Apps

自称「首个 LLM 模糊测试框架」的 100 行 PoC：其实不 fuzz、无模型在环，判定靠子串匹配——但那个确定性 oracle 是整类注入检测的地基 A 100-line PoC self-billed as "the first LLM fuzzing framework" — it doesn't fuzz, no model in the loop, verdict is a substring match; but that deterministic oracle is the foundation of the whole injection-detection class

2023-05 上线、2024-02 停更（官方标 Unmaintained），383 star / 29 commit / 单人维护，只有 2 个攻击（ignore-instruction + base64 绕过）。逐行读码：Headers/Cookie 声明了却从不发送、Output-Attribute 没用（扫全 body 会误报）、Reports 没实现、只实现 Contains+Absolute。想真跑 LLM 红队请用第 013 期 garak；这篇当源码教材读。 Shipped 2023-05, frozen 2024-02 (officially Unmaintained), 383 stars / 29 commits / solo, only 2 attacks (ignore-instruction + base64 evasion). Line by line: Headers/Cookie declared but never sent, Output-Attribute unused (scans the whole body → false positives), Reports unimplemented, only Contains+Absolute exist. For real LLM red-teaming use garak (issue 013); read this one as source-code teaching material.
https://github.com/mnns/LLMFuzzer 详细分析 → Deep dive →

第 017 期 No. 17

Cloudflare security-audit-skill Cloudflare security-audit-skill Cloudflare security-audit-skill GitHub stars Cloudflare Agent 技能：漏洞发现与修复 Agent Skills for Vulnerability Discovery & Remediation

Cloudflare 官方的 coding-agent skill：6 阶段编排，查 findings 的 agent 永远不是发现它的那个 agent Cloudflare's official coding-agent skill: a six-phase orchestration where the agent verifying a finding is never the agent that found it

侦察 → 覆盖驱动狩猎 → 候选验证 → 结构化输出 → 独立记录验证 → 中立报告；官方自己写进 README「单次运行只找到重复运行能找到的漏洞的一半」。短板：22.6k star 只有 14 次提交、MIT 但维护节奏存疑、效果强依赖宿主 agent 的模型与权限。 Recon → coverage-driven hunting → candidate validation → structured output → independent record verification → neutral reporting; the README itself states a single run finds only half of what repeated runs find. Caveats: 22.6k stars on just 14 commits, MIT but an uncertain maintenance cadence, and effectiveness depends heavily on the host agent's model and permissions.
https://github.com/cloudflare/security-audit-skill 详细分析 → Deep dive →

第 016 期 No. 16

Cisco Skill Scanner Cisco Skill Scanner Cisco Skill Scanner GitHub stars Agent Skills 安全审计 Security Auditing for Agent Skills

Cisco AI Defense 的 skill 扫描器：9 个分析引擎 + cel-go 类型化决策层，敢把 7.75% 召回率原样写进 README Cisco AI Defense's skill scanner: nine analysis engines over a typed cel-go decision layer, brave enough to publish a 7.75% recall in its README

静态 / 字节码 / 管道污点 / 关联 / AST 数据流 / LLM / Meta 误报过滤 / VirusTotal / AI Defense 云九引擎并联。短板：held-out 集召回率 7.75%（漏掉 92% 恶意 skill）、所有 CEL 规则还在 shadow 模式、Meta-analyzer 准确性验证官方标注 remains pending、许可证标识不一致。 Nine engines in parallel: static, bytecode, pipeline taint, correlation, AST dataflow, LLM, meta false-positive filtering, VirusTotal and the AI Defense cloud. Caveats: 7.75% recall on the held-out set (92% of malicious skills missed), every CEL rule still in shadow mode, meta-analyzer accuracy verification officially "remains pending", and inconsistent license metadata.
https://github.com/cisco-ai-defense/skill-scanner 详细分析 → Deep dive →

第 015 期 No. 15

NVIDIA SkillSpector NVIDIA SkillSpector NVIDIA SkillSpector GitHub stars NVIDIA Agent Skills 安全审计 Security Auditing for Agent Skills

回答「这个 skill 装了安全吗」：71 个漏洞模式 × 17 类别，静态 + 可选 LLM 语义两阶段，SARIF 直接进 CI Answers "is this skill safe to install?": 71 vulnerability patterns across 17 categories, static plus optional LLM semantic analysis, SARIF straight into CI

背后那条研究数据是重点：分析的 31,132 个 skill 里 26.1% 含漏洞、5.2% 疑似恶意。短板：静态规则对语义级后门覆盖有限、LLM 阶段引入成本与不确定性、生态绑定 NVIDIA 工具链。 The research behind it is the point: of 31,132 skills analyzed, 26.1% contain vulnerabilities and 5.2% show likely malicious intent. Caveats: static rules cover semantic-level backdoors only so far, the LLM stage adds cost and nondeterminism, and the tooling ties into the NVIDIA ecosystem.
https://github.com/NVIDIA/SkillSpector 详细分析 → Deep dive →

第 014 期 No. 14

Rebuff Rebuff 已归档 · 史料Archived Rebuff GitHub stars AI 智能体与应用安全审计 Security Auditing for AI Agents & Apps

prompt injection 防御史上的绕不开的一章：canary token 检测 + 向量库自我加固的四层防线（仓库已归档，按史料读） An unavoidable chapter in prompt-injection defense history: canary-token detection plus vector-store self-hardening across four layers (archived — read it as history)

archived=true、最后提交 2024-08-07，不要在新项目里用它；但「让检测器把成功攻击样本变成自己的免疫记忆」这个设计至今少见。本篇按史料 + 设计解析写，不是推荐安装。 archived=true with the last commit on 2024-08-07 — do not use it in new projects; but the design of turning successful attack samples into the detector's own immune memory is still rare. Written as history plus design analysis, not an install recommendation.
https://github.com/protectai/rebuff 详细分析 → Deep dive →

第 013 期 No. 13

garak garak garak GitHub stars NVIDIA LLM 驱动的漏洞扫描器 LLM-Powered Vulnerability Scanners

NVIDIA 的 LLM 漏洞扫描器：懂 nmap / Metasploit 的话，garak 对 LLM 干的是差不多的事 NVIDIA's LLM vulnerability scanner: if you know nmap / Metasploit, garak does roughly the same thing to LLMs

21 类探针家族持续施压直到模型失守，arXiv 2406.11036 + DEF CON 演讲，领域事实基准。短板：471 个 open issues、atkgen 还是 prototype、默认每条 prompt 生成 10 次导致全量跑账单难看、只报问题不修问题且 detector 有误判。 21 probe families keep pressing until the model concedes; arXiv 2406.11036 plus a DEF CON talk make it the de facto benchmark of the field. Caveats: 471 open issues, atkgen still labeled prototype, 10 generations per prompt by default makes full runs expensive, and it reports rather than fixes, with detector false positives.
https://github.com/NVIDIA/garak 详细分析 → Deep dive →

第 012 期 No. 12

Vigolium Vigolium Vigolium GitHub stars LLM 驱动的漏洞扫描器 LLM-Powered Vulnerability Scanners

双引擎漏洞扫描器：208 主动 + 117 被动 Native 模块打底，Go 版 agentic 运行时（Autopilot / Swarm）在上 A dual-engine vulnerability scanner: 208 active + 117 passive native modules underneath, a Go agentic runtime (Autopilot / Swarm) on top

Native 引擎带 OAST、语义感知变异、多会话 IDOR/BOLA；Agentic 模式会自写攻击插件。短板：官方 SECURITY 自曝 agent 模式无沙箱（LLM 对宿主机有完整 shell / 文件 / 网络权限）、扩展可执行任意命令、README 与 API 许可证标识不一致。 The native engine brings OAST, semantics-aware mutation and multi-session IDOR/BOLA; the agentic mode writes its own attack plugins. Caveats: the official SECURITY section admits agent mode has no sandbox (full shell / file / network access on the host), extensions can execute arbitrary commands, and README vs API license metadata disagree.
https://github.com/vigolium/vigolium 详细分析 → Deep dive →

第 011 期 No. 11

deepsec deepsec deepsec GitHub stars LLM 驱动的漏洞扫描器 LLM-Powered Vulnerability Scanners

Vercel Labs 的 agent 驱动漏洞扫描器：不扫 diff、不扫增量，对存量大型仓库做一次全量深挖 Vercel Labs' agent-driven vulnerability scanner: no diffs, no increments — one full-depth audit of an existing large codebase

scan 用免费正则收窄候选、process 让高 thinking 模型只看候选，是对 token 成本的基本尊重；报告 / 导出 / CI 文档齐全。短板：全量模式一次扫描可达数千到数万美元、项目仅 5 个月、主路径绑 Vercel AI Gateway、69 个 open issues。 scan narrows candidates with free regex matchers and process lets a high-thinking model read only those candidates — basic respect for token cost; solid report / export / CI docs. Caveats: a full run can cost thousands to tens of thousands of dollars, only 5 months old, main path tied to Vercel AI Gateway, 69 open issues.
https://github.com/vercel-labs/deepsec 详细分析 → Deep dive →

第 010 期 No. 10

Dark-Moon Dark-Moon Dark-Moon GitHub stars AI 红队测试框架与 Agent AI Red Teaming Frameworks & Agents

把真实 IP / 主机 / URL / 凭证在本地换成确定性占位符、只在工具执行那一刻还原：50 个专家 agent + 140+ 真实工具的自主渗透平台 Real IPs, hosts, URLs and credentials become deterministic local placeholders, restored only at tool-execution time: an autonomous pentest platform with 50 specialist agents and 140+ real tools

Privacy Gateway 的可逆本地 tokenization 在主流程里而非插件位，占位符确定性所以模型仍能做关联推理；Docker Compose 全栈、可全本地模型跑。短板：GPL-3.0、Pro 版存在感过强、57 漏洞 benchmark 是云端 Claude 跑的、社区样本小。 The Privacy Gateway's reversible local tokenization sits in the main flow rather than a plugin slot, and deterministic placeholders let the model still correlate. Docker Compose full stack, runs fully on local models. Caveats: GPL-3.0, heavy Pro-tier presence, the 57-vuln benchmark was run on cloud Claude, small community sample.
https://github.com/ASCIT31/Dark-Moon 详细分析 → Deep dive →

第 009 期 No. 9

LuaN1ao LuaN1ao LuaN1ao GitHub stars AI 红队测试框架与 Agent AI Red Teaming Frameworks & Agents

把每条渗透结论钉回证据链：P-E-O 三角色 + 三图分离 + Evidence→Hypothesis→Vulnerability→Exploit 因果链 Pinning every pentest finding to evidence: Planner-Executor-Observer roles + three graph separations + an enforced Evidence → Hypothesis → Vulnerability → Exploit chain

TypeScript + Pi SDK 重写的 v2 自主渗透 Agent：证据引用是 schema 层面的硬约束（没有 evidence 引用就写不进 Vulnerability / Exploit 节点）。Docker 出网收口在内核态，scope 校验确定性拒绝臆造网段。短板：AGPL-3.0、Node.js 25+、v2 benchmark 还没发、高危动作没有审批闸门。 v2 autonomous pentest agent rewritten in TypeScript on the Pi SDK — evidence references are an enforced schema constraint (no Vulnerability / Exploit node without evidence). Docker-based egress gating at the kernel layer, and deterministic scope checks reject any fabricated CIDR. Caveats: AGPL-3.0, Node.js 25+ required, no v2 benchmark published yet, and no human approval gate on high-risk actions.
https://github.com/SanMuzZzZz/LuaN1aoAgent 详细分析 → Deep dive →

第 008 期 No. 8

Agent Governance Toolkit Agent Governance Toolkit Agent Governance Toolkit GitHub stars Microsoft AI 智能体运行时管控 AI Agent Runtime Controls

微软开源的 AI Agent 运行时管控套件：把「请 AI 守规矩」换成「让 AI 没法不守规矩」 Microsoft's runtime governance suite for AI agents: from "asking AI to behave" to "making it structurally incapable of misbehaving"

微软 2026-03 开源，MIT。每次工具调用前插确定性策略闸门，违规抛 GovernanceDenied；附带零信任身份与 kill switch，可上 CI 卡 OWASP/NIST/EU AI Act 合规。最大短板：策略未加载时默认 allow 静默失效。 MIT, open-sourced 2026-03. Inserts a deterministic policy gate before every tool call, message and delegation — violations raise GovernanceDenied. Adds SPIFFE/DID identity and a kill switch; CI can gate OWASP/NIST/EU AI Act compliance. The catch: fails open when no policies are loaded.
https://github.com/microsoft/agent-governance-toolkit 详细分析 → Deep dive →

第 007 期 No. 7

AgentShield AgentShield AgentShield GitHub stars AI 智能体与应用安全审计 Security Auditing for AI Agents & Apps

Claude Code 黑客松作品 / Everything Claude Code 生态：把 AI Agent 配置审计做成 0–100 分、可上 CI 的合规工具 A Claude Code Hackathon project from the Everything Claude Code ecosystem: a 0–100 graded audit of AI agent configurations that drops into CI as a compliance gate

Claude Code 配置审计器，268 条规则扫 .claude/ 里的密钥、tool permission、hook 注入与 prompt injection，输出 A–F 分级 + 0–100 分。亮点是 --fix 防篡改回滚，短板是 --opus 会把 .claude/ 内容外发到 Anthropic API。 Claude Code configuration auditor: 268 rules scan .claude/ for hardcoded secrets, tool permissions, hook injection and prompt-injection triggers, with A–F grades and a 0–100 score. Standouts are --fix with tamper-evident rollback; the catch is that --opus sends .claude/ contents to the Anthropic API.
https://github.com/affaan-m/agentshield 详细分析 → Deep dive →

第 006 期 No. 6

AI-Infra-Guard AI-Infra-Guard AI-Infra-Guard GitHub stars AI 智能体与应用安全审计 Security Auditing for AI Agents & Apps

腾讯朱雀实验室的全栈 AI 红队平台：五层能力覆盖 AI 基础设施 CVE、Agent 失控、MCP 供应链、Skill 后门与越狱评测 A full-stack AI red teaming platform from Tencent Zhuque Lab: five capabilities spanning AI infrastructure CVEs, agent loss of control, the MCP supply chain, skill backdoors and jailbreak evaluation

五能力并列的 AI 红队平台：AI Infra CVE 指纹、Agent 失控、MCP 供应链、Skill 后门、越狱评测。自带 FORGE-Bench / RogueHandoff-20 / SkillJack 三个自研基准与 3 篇论文（含 Black Hat Europe 2025）。短板：无认证不应上公网，4 个检测技能未完成。 Full-stack AI red-team platform with five parallel capabilities: AI infra CVE matching, agent loss-of-control, MCP supply chain, skill backdoors and jailbreak evaluation. Ships FORGE-Bench, RogueHandoff-20 and SkillJack benchmarks, plus three papers (two from Black Hat Europe 2025). Caveat: no authentication, and several sub-modules are unfinished.
https://github.com/Tencent/AI-Infra-Guard 详细分析 → Deep dive →

第 005 期 No. 5

NVIDIA OpenShell NVIDIA OpenShell NVIDIA OpenShell GitHub stars NVIDIA AI 智能体运行时管控 AI Agent Runtime Controls

面向自主 AI Agent 的安全私有运行时：用声明式 YAML 策略在文件系统、网络、进程、凭证四个维度设界，凭证只在策略放行后注入授权端点 A safe, private runtime for autonomous AI agents: declarative YAML policies enforce boundaries across filesystem, network, process and provider access, and credentials only flow into policy-admitted endpoints

Rust 写的 AI Agent 安全运行时，声明式 YAML 策略在文件 / 网络 / 进程 / 凭证四维度设界，三态拦截（允许 / 绑凭证 / 拒）；凭证从不落盘，只在策略放行后注入端点。NVIDIA 官方出品，目前 alpha，0.1.0 即将发布。 AI-agent secure runtime in Rust: declarative YAML policies gate filesystem, network, process and provider access with a three-state outbound filter (allow / bind credentials / deny). Credentials never touch disk and are injected only into policy-admitted endpoints. Officially from NVIDIA, currently in alpha.
https://github.com/NVIDIA/OpenShell 详细分析 → Deep dive →

第 004 期 No. 4

PentAGI PentAGI PentAGI GitHub stars AI 红队测试框架与 Agent AI Red Teaming Frameworks & Agents

全自主渗透平台：Docker 沙箱里跑 20+ 工具，13 个 agent 角色分工，四道闸门防止跑飞 A fully autonomous pentesting platform: 20+ tools in a Docker sandbox, 13 specialized agent roles, and four supervision gates to stop runaway runs

Go 写的全自主渗透平台，五层结构（核心 / 知识图谱 / 监控 / 沙箱工具 / 分析），13 个 agent 角色由四道闸门（调用上限 / Reflector / 执行监控 / 任务规划）监管。官方维护 vLLM + Qwen3.5-27B-FP8 气隙部署指南。 Autonomous pentesting platform in Go with five layers (core / knowledge graph / monitoring / sandbox tools / analytics), 13 agent roles supervised by four gates (call caps / Reflector / execution monitoring / task planning). Ships an official vLLM + Qwen3.5-27B-FP8 air-gapped deployment guide.
https://github.com/vxcontrol/pentagi 详细分析 → Deep dive →

第 003 期 No. 3

Cairn Cairn Cairn GitHub stars AI 红队测试框架与 Agent AI Red Teaming Frameworks & Agents

通用状态空间搜索引擎：不定义角色与工作流，给起点和终点，让 Agent 在黑板上自己搜路 A general state-space search engine: no roles, no workflows — hand it an origin and a goal and let agents find the path on a shared blackboard

黑板架构 + 事实/意图图，只有 Fact / Intent / Hint 三个原语；Worker 跑 OODA 循环，靠 Stigmergy 间接协作，角色在运行时涌现而非写死。腾讯云黑客松 AI 渗透挑战赛 610 队里唯一 AK（54/54）。 State-space search engine built on a blackboard + fact-intent graph with three primitives (Fact, Intent, Hint). Workers run OODA loops and coordinate via stigmergy; roles emerge at runtime. The only team to AK (54/54) at the Tencent Cloud AI Pentesting Hackathon out of 610.
https://github.com/oritera/Cairn 详细分析 → Deep dive →

第 002 期 No. 2

Shannon Shannon Shannon GitHub stars AI 红队测试框架与 Agent AI Red Teaming Frameworks & Agents

AI 渗透测试 Agent：读源码找攻击面，再真打一遍验证，只有跑通 PoC 的漏洞才进报告 An AI pentesting agent: read the source, map attack paths, then prove every finding with a real exploit — no PoC, no report.

六段流水线：侦察 + 代码分析双流候选 → 归并去重 → 利用 Agent 真打 → 打不穿就丢 → PDF/Markdown/SARIF 报告。原生接 GitHub Actions，只有 exploited 的发现才卡流水线。AGPL-3.0，会改目标状态，只打 staging。 Six-stage pipeline: recon and code analysis produce candidates, dedup, exploitation agents attack the live app, undemonstrated findings get discarded, and survivors become PDF / Markdown / SARIF. Native GitHub Actions; only exploited findings gate the pipeline. AGPL-3.0, staging only.
https://github.com/KeygraphHQ/shannon 详细分析 → Deep dive →

第 001 期 No. 1

CyberStrikeAI CyberStrikeAI CyberStrikeAI GitHub stars AI 红队测试框架与 Agent AI Red Teaming Frameworks & Agents

AI 原生的安全执行中枢：把自然语言意图转成受治理的行动，并把证据沉淀成可复用的运营记忆 An AI-native security execution hub: turns natural-language intent into governed action and bakes evidence into reusable operational memory.

Go + Eino 编排，100+ YAML 工具配方 + MCP，内置审批、调用前正则拦截、RBAC 与审计日志。它的差异不在能调多少工具，而在于敢不敢让 Agent 真的动手。 Go + Eino orchestration with 100+ YAML tool recipes plus MCP, plus first-class approval, pre-call regex intercept, RBAC and audit logs. Its edge isn't how many tools it can call — it's whether it dares to let the agent really act.
https://github.com/AIPentest/CyberStrikeAI 详细分析 → Deep dive →

订阅一下，明天接着看Subscribe to catch tomorrow's

没有固定更新点，看到一个值得写的就发一期。订 RSS 或关注专栏，知乎 / 微信公众号同步。 No fixed schedule — a new issue whenever a tool earns one. Subscribe via RSS, Zhihu or WeChat.

RSS 知乎专栏Zhihu column

同步更新于知乎专栏「Wester的AI安全札记」与微信公众号。 Also published on Zhihu and WeChat.