zero-lab-ai/skills ships 56 portable security skills in 10 installable plugins that turn coding agents like Claude Code and Codex into disciplined, authorized assessment assistants.
| Tool | zero-lab-ai/skills — a collection of 56 evidence-bound security skills in 10 installable plugins for AI agent harnesses |
| Category | AI agent security skills / assessment workflow automation |
| Primary Use | Loading structured, evidence-bound assessment methodology into agent harnesses such as Claude Code and Codex for penetration testing, red teaming, detection engineering, and purple teaming work |
| Safe Use | Explicitly scoped to authorized security work; the README states the skills do not grant permission, expand scope, or replace rules of engagement, and adversary-facing skills are designed to measure exposure and hand results to defenders |
| Telemetry Note | Skills emphasize evidence preservation and cleanup; the opsec-planning skill explicitly connects objectives to artifacts, detection risk, and cleanup, meaning defenders should see bounded, documented activity rather than uncontrolled scanning |
Most security tooling released for AI agents leans toward raw capability — an agent that can shell out to nmap or chain together exploit modules with minimal oversight. zero-lab-ai/skills from zero-lab.ai takes the opposite architectural stance: it is not a tool that executes attacks, but a library of methodological guardrails that constrain how an agent reasons about security work. The repository describes itself as portable, evidence-bound security skills for authorized defensive assessment, penetration testing, red teaming, detection engineering, purple teaming, and engagement operations. The operative word throughout is evidence-bound: every skill is designed to force the agent to tie its conclusions to verifiable inputs rather than inference, which is a discipline most offensively-inclined agent tooling conspicuously lacks.
The scale of the collection is substantial for a project at this maturity — 56 skills organized into 10 installable plugins, written primarily in Python and released under Apache-2.0. Rather than one monolithic capability set, the plugins are grouped into coherent bundles mapped to domains a professional team would recognize: agent-security, recon-operations, identity-security, application-endpoint-security, network-protocol-security, binary-forensics, detection-validation, engagement-operations, rag-security, and ml-system-security. The last two are notable because they extend beyond traditional offensive security into AI-specific surfaces — retrieval-augmented generation pipelines and ML serving infrastructure — territory where most security skill collections simply do not exist yet.
Installation is deliberately harness-agnostic. For Claude Code, the README documents a marketplace flow using /plugin marketplace add zero-lab-ai/skills followed by /plugin menu. For Codex, an analogous codex plugin marketplace add zero-lab-ai/skills sequence reads the same metadata. A ChatGPT Workspace Marketplace path exists via the repository's .claude-plugin/marketplace.json, with each skill carrying an agents/openai.yaml manifest holding display metadata. For any other agent harness, npx skills add zero-lab-ai/skills installs a cross-agent tree, or you can simply copy a single plugins/<bundle>/skills/<skill>/ directory into whatever location your harness scans — the README is explicit that nothing outside a skill directory is required at runtime. That portability contract, built around a SKILL.md convention, is the core design decision: skills are self-contained, composable, and not locked to any vendor's agent format.
The agent-security bundle is arguably the most conceptually interesting. Its four skills — agent-surface-audit, agent-runtime-validation, prompt-injection-assessment, and agent-trust-boundary-audit — address the emerging problem of securing AI agents themselves. agent-surface-audit reviews agent tools for poisoning, excess privilege, unsafe parameters, and deployment blast radius, while agent-runtime-validation validates deployed tools, memory, hooks, approvals, and identities using what the README calls benign sentinels — test objects that probe control behavior without adversarial effect. prompt-injection-assessment covers direct, indirect, retrieval, and tool-output injection channels, and agent-trust-boundary-audit examines authentication, authorization, and delegated authority across agent handoffs. Together these form a genuine methodology for assessing agentic systems, not just a checklist.
The identity bundle reveals the project's overall epistemic discipline. active-directory-attack-path analyzes evidence-backed AD paths while explicitly separating reachability from authorized traversal — a distinction that matters enormously in reporting, since conflating network reachability with actual access is one of the most common ways assessment findings get overstated. Similarly, credential-exposure-audit audits supplied credential evidence without using the credential material, and lateral-movement-map maps routes without confusing transport reachability with access. privilege-escalation-assessment ranks elevation paths across Windows, Linux, and cloud without overstating achieved privilege. Read together, these descriptions sketch a consistent philosophy: the agent's job is to characterize exposure from evidence, not to prove exploitation.
That same restraint carries into the network and binary bundles. covert-channel-assessment measures whether bounded synthetic channels are blocked, visible, detected, and cleaned up — framed as a defensive measurement exercise rather than an exfiltration tool. binary-fault-triage triages supplied fault evidence without execution or weaponization, and binary-fault-validation-readiness checks whether evidence is ready for separate isolated validation, effectively building a handoff gate between analysis and any downstream testing. memory-forensics-triage and rootkit-triage preserve evidentiary limits and use independent evidence views, language that suggests the authors have real incident-response and forensic background rather than purely offensive experience.
The detection-validation and engagement-operations bundles serve the purple-team audience. The former covers detection engineering, validation, telemetry, resilience, and what the README calls control evidence — the artifacts proving a control actually functions. The latter, with seven skills, handles the unglamorous half of professional security work: planning, AI threat modeling, evidence proof, findings, and report assembly. The inclusion of report-generation skills is telling; in practice, the gap between an agent that finds issues and one that produces defensible, client-ready documentation is where most automation fails, and treating findings assembly as a first-class skill acknowledges that.
The AI-specific bundles deserve attention from anyone assessing modern enterprise stacks. rag-security contributes retrieval-integrity-assessment — which uses benign canaries to test source, tenant, citation, and cleanup integrity — alongside rag-surface-recon for mapping connectors, indexes, filters, and exposed fields, and rag-data-exposure-audit for measuring tenant boundaries with controlled fixtures. ml-system-security audits model artifacts across their lifecycle from intake through revocation and retirement, tests whether decision-boundary changes propagate into security-relevant effects, and examines serving APIs and administrative surfaces. This is coverage aligned with how AI systems are actually deployed and attacked today.
The trust posture is stated bluntly in a README callout: the skills support authorized security work but do not grant permission, expand scope, or replace an organization's rules of engagement, and skills touching adversary behavior are designed to measure exposure, preserve evidence, and hand results back to defenders. Operationally, this means concepts like the ossec-planning skill connect objectives to artifacts, detection risk, abort conditions, and cleanup, and recon-automation-governance governs jobs, budgets, retries, and evidence custody — controls that make agent-driven assessment auditable rather than chaotic.
For teams already running Claude Code or Codex in security workflows, the practical value is methodology enforcement: an agent loaded with these skills is constrained to evidence-bound reasoning, scope discipline, and defensible reporting. For defenders, the telemetry implications are favorable — activity governed by these skills should look bounded, documented, and cleanable rather than noisy. Watch items are the usual ones for third-party skill collections: review the SKILL.md contents before installation, treat repo metadata as untrusted input to your agent, and pin to reviewed revisions. At roughly 260 stars, the project is young but unusually well-structured, and its architecture — portable folders, dual-harness metadata, no runtime dependencies outside each skill directory — makes it easy to adopt incrementally.
zero-lab-ai/skills.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.