AgentShield as an automated verification tool for MSSS compliance

[elliotllliu]

Hi! 👋

I'm the maintainer of AgentShield, an open-source security scanner for AI agent skills, MCP servers, and plugins.

I noticed MSSS mentions automated verification tools as a planned feature in the roadmap. AgentShield already covers many of the control domains in your standard:

Overlap with MSSS controls

MSSS Domain	AgentShield Coverage
Command injection	✅ backdoor rule — detects eval(), exec(), child_process with dynamic input
Path traversal	✅ sensitive-read rule — detects access to ~/.ssh, ~/.aws, ~/.kube
SSRF	✅ network-ssrf rule — detects user-controlled URLs, AWS metadata access
Credential leaks	✅ credential-hardcode + env-leak rules
Supply chain	✅ supply-chain + typosquatting rules
Secret redaction	✅ hidden-files rule — detects .env files with secrets

What we offer

• 30 detection rules with AST taint tracking (not just regex)
• Cross-file data flow analysis — traces imports and data paths
• Kill chain detection — 5-stage attack sequence identification
• Zero install: npx @elliotllliu/agent-shield scan ./server/
• 100% offline — no data leaves the machine
• CI/CD integration via GitHub Action + --fail-under scoring

Proposal

I'd love to explore how AgentShield could serve as an automated verification tool for MSSS compliance. For example:

1. Map AgentShield rules → MSSS control IDs
2. Generate MSSS-compatible JSON assessment reports
3. Auto-produce L1/L2 evidence artifacts

Would you be interested in collaborating on this? Happy to discuss further.

🔗 https://github.com/elliotllliu/agent-shield
📦 https://www.npmjs.com/package/@elliotllliu/agent-shield