Permiso Security has unveiled SandyClaw, a pioneering dynamic analysis platform designed for the security of AI agent skills.
Distinguished as the first of its kind, SandyClaw provides a sandboxed environment where skills are executed, capturing every action both at the large language model (LLM) and operating system levels. This analysis delivers verdicts supported by various detection engines. Customers using the Permiso platform will have unlimited access to this innovative solution.
Addressing Malicious Skills
AI agents rely on skills, which are downloadable capabilities necessary for interacting with tools, APIs, and services. Skill marketplaces have emerged as the primary software supply chain for these agents; however, they are increasingly targets for malicious skills publication. Traditional methods of securing these skills rely on either static code analysis or LLM-based evaluations, both of which fall short by not executing the skills, missing runtime behaviors.
Permiso's threat research team was one of the first to identify and document these malicious skills. Their research contributed to the development of SandyClaw.
Sandbox Detonation Methodology
SandyClaw is compatible with major agent frameworks such as OpenClaw, Cursor, and Codex
The SandyClaw platform utilizes sandbox detonation, a method familiar to cybersecurity experts when evaluating suspicious executables, now applied to AI agent skills. It meticulously records every LLM action, network call, domain resolution, file write, and environment variable access attempt.
The platform intercepts and decrypts SSL traffic, analyzing it with Sigma, Yara, Nova, and Snort engines complemented by custom detection rules from Permiso. SandyClaw is compatible with major agent frameworks such as OpenClaw, Cursor, and Codex.
Multi-Engine Detection
According to Paul Nguyen, Co-Founder and Co-CEO of Permiso Security, "Agents are only as trustworthy as the skills they run. As skill marketplaces become the primary distribution channel for agent capabilities, the ability to validate what a skill actually does before it reaches your environment becomes a security requirement, not a nice-to-have. That is what SandyClaw delivers."
Critical Capabilities
- Dynamic detonation with comprehensive behavioral recording at the LLM and OS levels, capturing network calls, file writes, and environment variable accesses.
- Multi-engine detection with Sigma, Yara, Nova, and Snort supported by Permiso detection rules, providing evidence-based verdicts.
- Full SSL intercept for decrypted outbound traffic visibility, revealing potential exfiltration attempts.
- Transparency in verdicts with detailed behavioral records, enabling security teams to verify findings independently.
- Support and integration across multiple agent frameworks, automatically analyzing skills upon detection of download or installation by the Permiso platform.
Emphasis on Runtime Behavior
Ian Ahl, CTO of Permiso Security, elaborated, "Most skill scanners inspect code or ask an LLM for an opinion. But real risk shows up at runtime: network activity, file writes, and access to sensitive environment variables. SandyClaw was built on the belief that behavior is more revealing than source code alone. We detonate the skill, capture everything it does, and let the evidence speak for itself."
Permiso platform users can now access SandyClaw, which is available immediately. Security teams interested in integrating this solution into their operations can start by registering at sandyclaw.permiso.io.
Permiso Security, the unified identity security platform, announces SandyClaw, the first dynamic analysis platform for AI agent skills. SandyClaw executes skills in a sandboxed environment, records every action at the LLM and operating system level, and delivers a verdict backed by multiple detection engines. Permiso platform customers receive unrestricted access.
AI agents require skills to perform useful work: downloadable capabilities that teach them how to interact with tools, APIs, and services. Skill marketplaces have become the software supply chain for AI agents, and attackers have already begun publishing malicious skills on these platforms. The current approach to skill security relies on static code analysis or LLM-based evaluation. Neither executes the skill, which means neither can detect behavior that only manifests at runtime.
Publishing malicious skills
Permiso's threat research team was among the earliest to publicly identify and document malicious skills in the wild. That research led directly to SandyClaw.
SandyClaw applies sandbox detonation, a methodology the cybersecurity industry has relied on for evaluating suspicious executables, to the agent skill ecosystem. It records every LLM action, network call, domain resolution, file write, and environment variable access attempt. SSL traffic is intercepted and decrypted. Analysis runs against Sigma, Yara, Nova, and Snort engines augmented with custom Permiso detection rules. SandyClaw works across all major agent frameworks including OpenClaw, Cursor, and Codex.
Multi-engine detection
"Agents are only as trustworthy as the skills they run. As skill marketplaces become the primary distribution channel for agent capabilities, the ability to validate what a skill actually does before it reaches your environment becomes a security requirement, not a nice-to-have. That is what SandyClaw delivers," said Paul Nguyen, Co-Founder and Co-CEO, Permiso Security
Key capabilities:
- Dynamic detonation with full behavioral recording that captures every action at the LLM and OS level, including network calls, file writes, environment variable access, and domain resolution.
- Multi-engine detection using Sigma, Yara, Nova, and Snort alongside custom Permiso detection rules, delivering evidence-backed verdicts rather than confidence scores.
- Full traffic visibility with SSL intercept that decrypts encrypted outbound traffic inside the sandbox, exposing exfiltration attempts that would be invisible to tools without decryption capabilities.
- Full verdict transparency that provides the complete behavioral record behind every determination, including every file written, domain resolved, and network call made, so security teams can verify the finding themselves rather than trusting an opaque score.
- Cross-framework support and platform integration covering OpenClaw, Cursor, Codex, and other agent frameworks, with the ability to automatically analyze skills when the Permiso platform detects a download or installation.
Sensitive environment variables
"Most skill scanners inspect code or ask an LLM for an opinion. But real risk shows up at runtime: network activity, file writes, and access to sensitive environment variables. SandyClaw was built on the belief that behavior is more revealing than source code alone. We detonate the skill, capture everything it does, and let the evidence speak for itself," said Ian Ahl, CTO, Permiso Security
SandyClaw is available now. Permiso platform customers receive unrestricted access. Security teams can sign up at sandyclaw.permiso.io to get started.
