GuardPilot — Website AI Chatbot Security Auditor

Deterministic security and trust auditing for AI agent prompts, skill files, manifests, and configuration text. Detects prompt injection, exposed credential patterns, risky permissions, dependency risks, and licensing signals without executing submitted content.

Scan GitHub repos for AI-agent, MCP-server & skill security risks: prompt injection, tool poisoning, hallucinated packages, secrets & dangerous code.

Scan AI agent repos, MCP servers, and coding-agent configs for unsafe eval, shell execution, package hallucinations, prompt injection, and MCP security risks.

Stop prompt-injection and jailbreaks before your agent reads them. Scans tool results, web pages, and user input for instruction-override, hidden Unicode tag-smuggling, ChatML token injection, and 30+ attack patterns. Returns a risk score, flags, and sanitized text.

Analyze HTTP security headers of any website. Check for Content-Security-Policy, HSTS, X-Frame-Options, and 15+ other security headers. Includes security ratings and recommendations. Essential for security audits and compliance testing.

Check websites for security.txt, extract security contacts, expiry, policy, hiring and compliance fields.

Website Security Auditor

zyrox/website-security-auditor

A powerful security tool to scan websites for exposed API keys and XSS vulnerabilities.

Security Headers Checker

pillowy_travel/security-headers-checker

Analyze HTTP security headers of websites and generate a security score. Detect missing headers like CSP, HSTS, X-Frame-Options, and more. Perfect for web security audits, vulnerability checks, learning, and automated monitoring.

Security.txt Checker - Website Security Contacts

benthepythondev/security-txt-checker

Check websites for security.txt disclosure files and extract contacts, policies, encryption keys, expiry dates and raw security metadata.

claudemd-security-auditor is an Apify Actor that scans any AI agent project's CLAUDE.md, .claude/hooks, and settings for hardcoded secrets, prompt-injection vectors, destructive commands, and exfiltration channels, returning a severity-ranked JSON + Markdown audit.