Local-first scan for leaked secrets, unsafe defaults, prompt injection, and dangerous agent tools — no signup, nothing leaves your machine.
AI agents and LLM apps have a new class of security risks — leaked API keys in prompts, exec() calls in agent tools, and prompt injection phrases that hijack agent behavior. Standard linters don't catch these. badgr-security-scan does, in one command, with no setup.
Flags API keys, tokens, and high-entropy values 16+ characters long, plus unsafe defaults like disabled TLS or auth bypasses.
Detects shell-execution patterns (exec(), child_process, rm -rf) and phrases that hijack agent behavior, such as "ignore previous instructions".
Prints a readable report or --json output with exit code 1 on any risk found — ready to drop into CI or a pre-commit hook.
npx badgr-security-scan --text "$(cat src/agent.ts)"Requires Node.js 18+.
Pass any text or code snippet with --text. Add --json for machine-readable output, or --no-prompt-injection to skip that check.
npx badgr-security-scan --text "$(cat src/agent.ts)" --jsonbadgr-security-scan
✗ secret API key or token found: API_KEY=sk_live_... (truncated)
✗ dangerous-tool exec() call detected — dangerous in agent tool context
✓ unsafe-default No unsafe auth defaults found
✓ prompt-injection No injection phrases found
2 risks found. Review before deploying.npx badgr-security-scan --text "$(cat src/agent.ts)" — no account needed to get started.