Add agentguard under Security, Compliance, & Legal

[tainguyen091994]

Adds agentguard to the Security, Compliance, & Legal section.

It scans agent extensions before you install them rather than scanning your application code. Targets are SKILL.md files, plugin.json and marketplace.json manifests, hook scripts, settings.json, and .mcp.json.

What the 19 rules catch, in short: prompt injection planted in a skill for the installing agent, credentials hardcoded into an MCP config, curl | bash inside a hook, hooks that read ~/.ssh or .env and post them somewhere, marketplace sources with no pinned commit SHA, and plaintext transport.

It complements the scanners already listed here rather than overlapping them. security-sweep and openclaw-security look at workspaces and application code; agentguard reads the extension manifests themselves and is meant to run before install or in CI on a plugin repo.

• License: Apache-2.0
• Rules are plain YAML with a good and a bad fixture each, so the rule set is auditable without reading the TypeScript
• Output is human-readable or SARIF, so GitHub code scanning picks it up
• npx @hachiman94/agentguard scan .

🤖 Generated with Claude Code