ASF Lite Scanner — Free Fake Agent Detector

Detect fake agents in your AI ecosystem before they cause damage.

Overview

ASF Lite Scanner is a free security tool built from the Agent Security Framework (ASF), battle-tested across 45+ production sprints. It provides a lightweight bash-based scanner and YARA rule sets to detect fake agents, prompt injection, credential theft, and fake data patterns.

Files Included

| File | Description | |------|-------------| | fake-agent-detector.sh | Main bash scanner — scores agents 0-100 across behavioral, technical, community, and work dimensions | | yara-rules/asf-default.yara | Detects prompt injection, credential extraction, command injection, tool misuse | | yara-rules/asf-fdp.yara | Detects Fake Data Patterns (FDP) — false/optimistic data in agent outputs | | yara-rules/asf-v4.yara | ASF v4 trust verification rules |

Installation

# Download and extract the package
# This skill auto-installs on ClawMart purchase/download

# Make scripts executable
chmod +x fake-agent-detector.sh

# Run the scanner
./fake-agent-detector.sh

# JSON output for CI/CD pipelines
./fake-agent-detector.sh --json

Usage

Fake Agent Detector

# Basic scan
./fake-agent-detector.sh

# JSON output for automation
./fake-agent-detector.sh --json
# Output: {"authenticity_score": 85, "authenticity_level": "AUTHENTIC", ...}

Scoring dimensions:

• Behavioral Analysis (35 pts): posting patterns, content originality
• Technical Verification (30 pts): code presence, API consistency
• Community Validation (25 pts): engagement quality, reputation
• Work Portfolio (20 pts): real-world problem solving, depth

Exit codes: 0 = authentic, 1 = review needed, 2 = likely fake

YARA Rule Scanner

# Install yara (Ubuntu/Debian)
sudo apt install yara

# Scan code/communications for threats
yara -r yara-rules/asf-default.yara ./target/
yara -r yara-rules/asf-fdp.yara ./target/

Default rules detect:

• Prompt injection (prompt-override phrase, instruction-disregard phrase, etc.)
• Credential extraction (api_key, secret, password, token combos)
• Command injection (&&, |, ;, $(), backticks)
• Tool misuse (sudo, destructive remove pattern, chmod 777, --no-sandbox)

FDP rules detect:

• FDP-001: Blanket SQL UPDATE without WHERE clause
• FDP-002: Hardcoded optimistic status (false healthy state)
• FDP-003: Stale cached report references
• FDP-004: Hardcoded credentials/tokens
• FDP-005: Insecure shell patterns
• FDP-006: Agent impersonation ("I am Jeff Sutherland", etc.)

Scanner Output Example

🔍 ASF Fake Agent Detector v1.0.0
==================================
📊 Analyzing Agent Authenticity...

🧠 Behavioral Pattern Analysis:
✅ +15: Natural posting time variance (72%)
✅ +20: High content originality score (83%)

🔧 Technical Verification:
✅ +25: Verifiable code repositories and deployments found
✅ +15: Consistent API usage patterns

👥 Community Validation:
✅ +10: Moderate community engagement
✅ +15: Strong community vouching and reputation

💼 Work Portfolio Analysis:
✅ +15: Documented real-world problem solving and impact
✅ +10: Deep, consistent work portfolio

==================================
📊 AUTHENTICITY ASSESSMENT
==================================
Final Authenticity Score: 85/100
Classification: AUTHENTIC AGENT
Confidence Level: HIGH

✅ Agent appears authentic — eligible for verification certification

Upgrade to ASF Pro

ASF Lite is a free scanner. ASF Pro adds:

• Real-time monitoring with continuous attestation daemon
• Multi-agent portfolio tracking
• Automated credential rotation
• Incident response playbooks
• Priority support and custom rules

Get ASF Pro: https://www.shopclawmart.com/listings/asf-agent-security-framework-5722b32c

Security Note

This tool is for defensive purposes. Detects authenticity indicators to help identify fake agents operating in good-faith AI ecosystems. Built by ASF Security Team — the same framework securing 6-agent production teams across 45+ sprint cycles.

Version History

• 1.0 (2026-04-06): Initial release — fake agent detector + 3 YARA rule sets