A selection of new open-source cybersecurity tools has been highlighted for their potential to improve security across various environments. These tools include solutions for AI agent security, software supply chain integrity, and automated penetration testing.
NVIDIA has released SkillSpector, an open-source security scanner designed to evaluate AI agent skills. Users can point SkillSpector at a directory, a zip file, a single SKILL.md file, or a Git URL. The tool then provides a list of findings, a risk score, and recommendations regarding the skill's safety for installation.
Another tool, Future AGI, offers an open-source platform for managing self-improving AI agents. Licensed under Apache 2.0, this self-hostable platform supports tracing, evaluating, simulating, and guardrailing Large Language Model (LLM) agents. Upon its initial boot, a self-hosted instance of Future AGI registers with the main Future AGI service, transmitting an instance ID, a version string, a deployment type, and the email addresses and domains of active administrative users.
For software supply chain security, Chainloop functions as an open-source evidence store and policy engine. This tool operates as a command-line interface within various CI/CD pipelines, including GitHub Actions, GitLab, Jenkins, or Dagger. It collects build artifacts, uploads them to content-addressable storage, and then references each artifact in a signed in-toto attestation. The in-toto specification is used to record the execution steps of a build process, enabling subsequent verification.
PentestGPT is an open-source agentic framework for automated penetration testing. This tool directs a large language model at a target system. In its default mode, it progresses through reconnaissance, exploitation, and walkthrough stages, with each stage informing the next. When switched to "pentest mode," the stages become asset discovery, vulnerability identification, and report generation, operating without human intervention.
Finally, Hazmat provides open-source containment for AI agents. This tool runs AI coding agents within a separate account on the user's machine. It supports various existing harnesses, such as Claude Code, Codex, OpenCode, and Cursor Agent, as well as custom scripts.
