Mondoo AI Security Tool Targets Supply Chain Risks

Mondoo has introduced AI Skills Check, a free security tool designed to help organizations assess the risks associated with third-party AI agent skills before deploying them. The launch comes as enterprises increasingly adopt agentic AI systems, where external “skills” or plugins can perform tasks on behalf of users. While these capabilities enhance automation, they also introduce a new layer of supply chain risk. Mondoo highlighted recent identifying over 1,100 malicious skills on public registries, many of which were available for download before being detected.

AI Skills Check aims to provide visibility into this largely ungoverned ecosystem. The tool allows users to search for AI agent skills using names, registries, or package URLs, offering insight into how these components behave and what risks they may pose. It is designed to work across multiple environments, including popular AI development platforms and frameworks, while remaining independent of any single marketplace. Unlike traditional registry-based scanners, the platform analyzes skills across different sources and compares their stated functionality with actual behavior. This helps identify discrepancies, hidden actions, or potential misuse before a skill gains access to sensitive systems or credentials.

Patrick Münch, Co-Founder and Chief Security Officer at Mondoo, said the rapid adoption of AI agents has created a visibility gap, with organizations often unaware of what third-party skills can access or execute. He noted that the new tool is intended to provide a baseline level of security awareness without requiring a subscription.