askalf

Askalf — Security skill for Claude Code

Security community

Own Your Stack: open-source agent security (redstamp · truecopy · plumbline) and AI infrastructure you own instead of rent by the token.

How to install Askalf

This entry records only its repository, not the path inside it, so there is no exact command to give. Open askalf/askalf and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Askalf does

Own Your Stack: open-source agent security (redstamp · truecopy · plumbline) and AI infrastructure you own instead of rent by the token.

Alternatives in Security

Token Scan — Meme coin and token security scan — checks for rug pull vectors (hidden mint, honeypot, fee manipulation, LP l 3.8k ★
Anthropic Cybersecurity Skills — 734+ structured cybersecurity skills for AI agents · MITRE ATT&CK mapped · agentskills.io open standard · Work 3.8k ★
Mcp-scan (Invariant Labs) — MCP security scanner with proxy mode for real-time scanning without infrastructure changes 1.9k ★

README

**Two questions, two answers.** What are your agents *allowed to do*? And what do they *run on*?

[Own Your Agent Security](#own-your-agent-security) · [Own Your Stack](#own-your-stack) · [The operation](#the-operation) · [Receipts](#receipts) · [Who](#thomas-sprayberry)

Agents are useful because they act. That is also the whole risk: a tool call that runs a shell, a skill fetched from a marketplace, a browser session on a hostile page. **Own Your Agent Security** is the answer to the first question: deterministic gates around what an agent may do, running in production here. **Own Your Stack** is the answer to the second: the subscription you already pay for, on your own box, routed and guarded by tools you can read in a weekend, instead of intelligence rented by the token through someone else's pipes.

Everything below is open source, and everything below runs the operation that ships it.

Own Your Agent Security

An agent's tool calls pass through redstamp, its skills through truecopy, and plumbline watches the whole sequence from out of band before anything reaches tools, skills or the web.

**Don't trust agents by default.** A firewall for every tool call, a supply-chain gate for every skill and MCP server, and a trajectory monitor watching the whole sequence. Each closes a different hole; together they are one layered defense.

	own your…	what it does
redstamp	agent security	A deterministic, offline firewall for agent tool calls. Blocks RCE, secret exfiltration, SSRF, prompt injection and poisoned MCP tools, with a tamper-evident audit trail. Governs CrewAI, LangGraph, the OpenAI Agents SDK and AutoGen with run