Security Concerns for AI Agents

Things on this page are fragmentary and immature notes/thoughts of the author. Please read with your own judgement!

Tips & Traps¶

Exposing LLM API keys as environment variables can be a security concerns due to prompt injection attack. A safer alternative is to store your LLM API keys in a command line password manager.

code-on-incus (COI)¶

code-on-incus (COI) gives each AI agent its own machine - a full system container with root access, systemd, Docker, and the ability to install anything. Agents work like they would on a real server: run services, manage packages, use cron - without touching your actual system. Files stay correctly owned, no permission hacks needed.

anthropics/skills#557 feat: add security-scanning skill for LLM safety guardrails

https://repello.ai/blog/ai-agent-skill-scanner AI Agent Skill Scanners: Every Tool Compared (2026)

Cisco skill-scanner

SkillCheck (Repello)

https://skillforge-tawny.vercel.app/scanner