A comprehensive security testing harness providing 470 executable protocol and behavioral tests for AI agent systems.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install agent-security-harness
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install agent-security-harness using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Agent Security Harness?
The Agent Security Harness is a professional-grade defensive security tool specifically engineered for AI agent operators. It serves as a specialized auditor that probes autonomous systems for protocol-level vulnerabilities, ensuring that even properly authorized agents cannot be manipulated into unsafe or policy-violating behaviors. This tool is essential for developers building robust Openclaw Skills who need to validate their systems against modern adversarial tactics.
Built on peer-reviewed research and aligned with NIST AI 800-2 standards, the harness acts as the agentic-AI equivalent of network security staples like nmap or Burp Suite. It provides a structured methodology for red-teaming agent fabrics, covering everything from JSON-RPC injection in MCP servers to complex payment challenge crafting in L402 and x402 wire protocols.
Agent Security Harness Use Cases
- Perform deep security audits on MCP servers before they reach production environments.
- Execute red-team scenarios on agent-to-agent (A2A) pipelines to verify delegation and provenance.
- Validate L402 and x402 payment endpoints against token replay and downgrade attacks.
- Conduct AIUC-1 compliance mapping for automated agent certification requirements.
- Implement a security-first CI/CD gate for every update made to your Openclaw Skills ecosystem.
How Agent Security Harness Works
- Installation: The tool is deployed via pip as a CLI utility or an MCP server.
- Target Selection: The operator identifies the target endpoint, such as a local MCP server or a remote x402 payment gateway.
- Test Execution: The harness runs a suite of non-destructive protocol probes that simulate adversarial messages and behavior.
- Analysis: Results are generated based on the agent's response to tool injection, capability escalation, and jailbreak attempts.
- Hardening: Developers use the findings to patch protocol vulnerabilities within their Openclaw Skills before final deployment.
Agent Security Harness Setup
Install the package directly from PyPI:
pip install agent-security-harness
Ensure the local bin is in your path, then run a simulation to verify the installation:
agent-security test mcp --simulate
To test a live endpoint, point the harness at your server URL:
agent-security test mcp --url http://localhost:8080/mcp
Agent Security Harness Data Schema & Taxonomy
The harness organizes its security tests into specific layers to provide granular feedback on system integrity:
| Layer | Scope | Tests |
|---|---|---|
| MCP Protocol | JSON-RPC attacks, tool injection, escalation | 18 |
| A2A Protocol | Trust delegation, provenance verification | 13 |
| L402 Payment | WWW-Authenticate flow, token replay | 33 |
| x402 Payment | Challenge crafting, validation bypass | 52 |
| Governance | Autonomy scoring, policy constraint testing | 8+ |
| Jailbreak | 25 jailbreak and 25 false-positive tests | 50 |
| APT Simulation | Nation-state pattern reproductions | 17 |
Agent Security Harness Advanced Features
- MCP Server Mode: Expose the harness as an MCP server using stdio or hardened HTTP transport for orchestrator-led testing.
- GitHub Actions Integration: Native support for automated security regression testing in development pipelines.
- APT Pattern Simulation: Reproduce 17 nation-state pattern behaviors (GTG-1002) to test resilience against advanced threats.
- Privacy-First Testing: No telemetry by default and zero-knowledge credential handling for sensitive Openclaw Skills environments.
- AIUC-1 Mapping: Built-in alignment with 19 of 20 testable AIUC-1 requirements for enterprise-ready compliance.
SKILL.md
Loading
Related Openclaw Skills
Kleinanzeigen Assistant Skill
An intelligent automation skill for generating, researching, and staging classified ad drafts on kleinanzeigen.de.
Liuyao Divination
A sophisticated AI divination tool providing I Ching readings through virtual coin simulation and cross-cultural philosophical analysis.
Podcast to Video
An AI-powered tool that converts podcast audio files into professional videos with captions and waveform animations for social media.
Claude Delegate
Claude Delegate provides a local worker lane to integrate Claude Code subscription access directly into OpenClaw agents.
Liuyao Divination Agent
An AI-powered traditional Chinese divination skill that combines ancient I Ching wisdom with Python-driven hexagram generation.
Agent Constitution Guard
A robust framework for defining immutable behavioral rules, permission boundaries, and safety interlocks that AI agents cannot override.
Featured*
