Agent Security Regression Pack 20260815 - Release Notes

What It Does

Agent Security Regression Pack helps teams verify that an agent security baseline has not drifted during a release or configuration change. It checks redacted notes for threat model evidence, permission boundaries, tool allowlists, network limits, authentication checks, prompt-injection cases, sensitive-output checks, restore points, and rollback results.

The pack is local, read-only, and deterministic. It turns security regression evidence into a buyer-readable PASS, REVIEW, BLOCKED, or ERROR report without inspecting secrets or changing the workspace.

Use Cases

• Security reviewers validating an agent release before marketplace listing or internal rollout.
• Operators comparing baseline and candidate versions for permission, network, and auth drift.
• Teams preserving reproducible regression evidence before handoff to QA or governance.

Requirements

• Python 3 with standard-library modules only.
• Redacted notes supplied via --text or one explicit local notes file.
• No API keys required.
• OpenClaw workspace capable of running local skill scripts.

Example Usage

python3 scripts/agent_security_regression_pack.py --text "baseline version recorded; candidate version recorded; threat model reviewed; permission baseline checked; tool allowlist verified; network boundary documented; authentication check passed; prompt injection case tested; sensitive output check passed; restore point exists; rollback result captured; review owner assigned" --json

Expected output: JSON containing verdict: "PASS", the matched security evidence signals, and mutated_files: []. Missing evidence returns REVIEW; serious risk language or poor coverage returns BLOCKED.

Price

$4.99