MistEye Security Gate Officially Released, Strengthening the Frontline Detection Defense for AI Agents
The SlowMist security team has officially released MistEye Security Gate, a front-end security gateway skill that provides pre-execution security detection capabilities for dependency installation and domain access for mainstream AI coding agents such as Claude Code, Cursor, and OpenAI GPT. It covers three core risk scenarios: supply chain poisoning, malicious external links, and third-party Skill/MCP installation.
MistEye Security Gate Open-Source Repository ：github.com/slowmist/misteye-skills
I. Background: AI Agent Skill Ecosystem and Supply Chain Risks
With the rapid adoption of AI coding tools such as Claude Code, Cursor, and Codex, “Skills” and “MCP (Model Context Protocol)” have become essential capability extensions in developers’ daily workflows. By declaring .claude/settings.json in a project or installing third-party Skill repositories, AI agents can obtain extended capabilities such as browser control, file editing, and database querying.
However, the open nature of this ecosystem also introduces significant security challenges:
- Supply chain poisoning: Third-party Skills or MCPs may rely on Python/Node.js/Go packages that can be maliciously tampered with, introducing backdoors.
- Malicious external links: AI agents may be tricked into accessing phishing websites or malicious domains during task execution.
- Privilege abuse: Unverified Skills may read sensitive files (such as ~/.ssh, ~/.aws), exfiltrate data, or execute arbitrary commands.
In February 2026, the SlowMist security team discovered that ClawHub, the plugin center of OpenClaw, was under a large-scale supply chain poisoning attack. Attackers disguised “dependency installation/initialization” steps in SKILL.md files and used Base64 encoding to conceal malicious commands, forming a two-stage attack chain. Security scans identified 472 malicious Skills. These malicious programs were used to steal user passwords, collect host information and documents, and upload data to attacker-controlled servers. The related infrastructure was found to be associated with the Poseidon hacking group (see Threat Intelligence | Analysis of ClawHub Malicious Skills Poisoning).
Subsequently, in March, SlowMist further observed an escalation of the attack — attackers used leaked GitHub credentials to log into ClawHub as developers and publish malicious Skills containing backdoors, forming a complete attack chain from credential theft to supply chain poisoning.
Based on continuous tracking of AI agent security threats, the SlowMist security team positioned MistEye Security Gate as a front-end security gate in AI agent execution pipelines, ensuring that every dependency installation and every domain access is subject to real-time threat intelligence detection.
II. Core Capability: Detect First, Execute Later
The core design philosophy of MistEye Security Gate is a simple but strict principle: before any high-risk operation is executed, it must first pass real-time detection via the MistEye threat intelligence API. If the API returns a malicious result, the operation is hard-blocked, cutting off the risk at its source.
2.1 Three Major Detection Scenarios
2.2 Supported Detection Types
The MistEye detection API currently covers 15 detection types, grouped into three main categories:
Network and identity types:
ip、ip:port、domain、url、email
File hash types:
file_hash、md5、sha1、sha256
Supply chain package types:
package:npm、package:pypi、package:nuget、package:rubygems、package:go、package:cratesio
2.3 Blocking Decision Matrix
Detection results follow strict blocking rules, with no “gray area” allowed:
When the detection result is “not checked” or “detection error”, the system defaults to a hard-blocking strategy to ensure that no security blind spots are introduced due to API unavailability.
2.4 Post-Blocking Handling and False Positive Feedback
Hard blocking does not mean “no way forward.” When a block is triggered, MistEye fully outputs detection evidence (matched IOC type, match details, and threat tags), allowing users to understand why the operation was blocked.
If you believe a blocking event is a false positive, it can be handled in the following ways:
- Manual review bypass: After confirming safety, developers may manually execute the previously blocked command (e.g., directly running pip install). The MistEye gate logic operates at the AI agent layer and does not modify system-level package managers, so it will not create a permanent lock.
- False positive feedback: Submit false positive reports via SlowMist’s official channels (WeChat public account or GitHub Issues). The security team will update and refine the threat intelligence database accordingly.
- Granular blocking, not full-system lockdown: MistEye enforces blocking at the granularity of individual dependencies or domains. It will not block all other dependencies in a project due to a single risky detection, nor will it interfere with unrelated AI agent operations.
III. Working Mechanism: A Complete Closed Loop from Dependency Declaration to Security Decision
The workflow of MistEye Security Gate can be summarized into four steps:
Parse dependency declarations → Generate detection tasks → Call MistEye API → Output block/allow decision
3.1 Full Dependency Scanning and Coverage Threshold
Unlike common coarse-grained approaches that only check whether a package manager’s domain is trusted, MistEye requires an independent supply chain package lookup for every dependency parsed from dependency declaration files.
Example workflow:
When an AI agent detects requests==2.32.3 in a requirements.txt file, MistEye constructs the following API request:
{
“target”: “requests@2.32.3”,
“type”: “package:pypi”
}
After calling the MistEye API, the system decides whether to allow execution based on the safe field and the matches array.
To ensure no detection is missed, the system enforces a requirement that the number of dependency package detections must be greater than or equal to the number of dependency items (i.e., dependency_package_detect_count >= dependency_item_count). This coverage threshold structurally prevents shortcut behaviors such as only checking registry domains while skipping actual package-level inspection.
3.2 Supported Dependency Declaration Formats
MistEye covers the package management formats of mainstream programming languages:
IV. Daily Inspection: From One-Time Checks to Continuous Operations
Security is not a point-in-time action, but a continuous process. The pre-execution detection described earlier addresses whether something is safe at the moment of installation. However, threat intelligence is dynamic — an package may not be flagged as malicious at installation time, but later be confirmed as a supply chain poisoning vector after the MistEye threat intelligence database is updated. Without continuous detection, such “initially safe but later malicious” dependencies can become hidden blind spots.
Daily inspection is designed precisely for this purpose: it repeatedly scans already installed Skill/MCP dependencies to detect malicious items that were not previously flagged but have since been identified through updated intelligence. MistEye Security Gate supports configuring automated daily inspections via two task schedulers, OpenClaw and Hermes (default time: 3:00 AM Asia/Shanghai), enabling full lifecycle security checks for Skill dependencies.
4.1 Inspection Steps
Daily inspection follows a fixed execution sequence:
1.Network connectivity pre-check: Ensure the MistEye API can be accessed normally
2.Credential pre-check: Verify that MISTEYE_API_KEY is valid and usable
3. Version update check: Compare the local SKILL.md version with the latest upstream repository version
4. Installed Skill/MCP dependency inspection: Recursively scan dependency declaration files of all installed Skills and perform full detection
5. New version notification: If a new version is detected, notify the user to update
6.Inspection summary output: Aggregate and report the results of the daily inspection
Create inspection task:
Detection Result:
4.2 Degraded Mode
When network access is limited or the API key is unavailable, the system enters a degraded mode: Only local file statistics are performed, and the result is marked as degraded, without declaring the detection as successful. This ensures that even in constrained environments, users are not given a false sense of security due to potential “false negatives.”
V. Deployment and Integration
5.1 Get Skills
Official repository: https://github.com/slowmist/misteye-skills
5.2 Obtain API Key
MistEye API keys can be obtained for free by following these steps:
1. Visit app.misteye.io/api-keys
2.After registering a free account, you can create an API key at no cost
3. Copy the generated API key and configure it locally as described in the next section to start using it
Registration and API key creation are completely free and do not require linking any payment method. API documentation is available at app.misteye.io/api-docs.
5.3 Configure API Key
After obtaining the API key, MistEye will automatically read it based on the following priority:
1. Environment variable MISTEYE_API_KEY
2. File $MISTEYE_CONFIG_DIR/api_key
3. File ~/.config/misteye/api_key (file permission requirement: 600)
Security reminder: The API key should not be hardcoded into any project files, nor should it be committed to version control systems.
5.4 Verify Installation
After installation, MistEye will trigger a post-installation prompt, recommending that users enable daily automated inspections:
Installation complete. It is recommended to enable proactive inspection: default is once per day.
The inspection will first check whether https://github.com/slowmist/misteye-skills has a new version; if an update exists, it will prompt the user before continuing.
The inspection mainly performs three tasks:
1.Check for version updates
2.Scan dependency declarations of installed Skills/MCPs, prioritizing package:* supply chain direct lookups, then run MistEye detection on extracted URLs/domains/emails/hashes
3.Aggregate and display results in a consolidated view. The main purpose is to transform “manual patch-based security checks” into a daily automated operational process, enabling earlier detection of supply chain poisoning, malicious external links, and missed detections caused by rule invalidation.
Afterwards, whenever an AI agent executes dependency installation commands such as pip install, npm install, or accesses external URLs, MistEye will automatically trigger pre-execution detection (output format shown in Chapter 7: Practical Scenarios).
VI. Design Features
6.1 Pure Rule-Driven, Zero Script Dependency
MistEye Security Gate contains no executable scripts (no .sh files, no binaries, no executable code). All detection logic is defined in the form of Skill rule files (SKILL.md), which are parsed and executed by the AI agent at runtime.
This design:
- Eliminates supply chain risks within the Skill itself — users can directly review the full contents of SKILL.md
- Maximizes cross-platform compatibility — any AI agent supporting the Skill specification can use it
- Reduces maintenance overhead — rule updates only require replacing the SKILL.md file
6.2 Zero Trust Pre-Execution
MistEye does not trust any dependency or domain by default. Even if a developer assumes a package “should be safe” based on experience, it must still be verified through API-based detection.
The zero-trust principle is enforced throughout the entire execution chain.
6.3 Hard Blocking Mechanism
When a risk is detected, MistEye enforces a hard block — AI agents are not allowed to bypass or ignore detection results. This means:
- There is no gray area of “warn only but allow execution”
- “Detection failure” is treated as “unsafe,” resulting in a block rather than a pass
- When the API is unavailable, the system prefers blocking over blind approval
6.4 Openness
MistEye’s rule files, scheduler templates, and API documentation are all open source. Users can audit, customize, or integrate them into their own security systems.
VII. Practical Scenarios: What It Looks Like in Your Daily Workflow
The technical description above may feel like “just another security framework.” Let’s walk through several real-world scenarios to see what MistEye actually does in daily use.
Scenario 1: AI asks you to install an unfamiliar package
You are using Claude Code to write a data processing script, and the AI agent suggests: pip install data-cleaning-toolkit. You’ve never used this package before — can it be trusted?
With MistEye enabled, the AI agent does not directly execute the installation. Instead, it first outputs a detection result:
🔍 Threat Intelligence Details
Detection hits (0 items):
- Target: urllib3==2.2.1 → package:pypi
- Status: safe=true, matches=0
- Intelligence source: misteye_internal
✅ This dependency is not flagged as malicious; installation may proceed (manual review recommended).
The entire process is transparent. You see the detection evidence before installation proceeds. No extra steps are added, but one hidden risk is removed.
Scenario 2: A colleague sends you a link to “check it out”
During a discussion, a colleague sends you a link and asks you to take a look. You pass the link to the AI agent.
MistEye intercepts the request before any access occurs and performs threat intelligence analysis on the domain and URL:
🚨 Threat Intelligence Details
Detection hits (1 item):
- Domain: zahnarztpraxis-rogal.ch
- Severity: High
- Confidence: 100%
- First seen: 2026–05–07 14:22 UTC
- Expiry: 2026–08–05
- Intelligence source: misteye_internal
⛔ External link flagged as malicious. Access blocked.
In this case, MistEye prevents a potential phishing attempt before the AI agent retrieves any page content.
Scenario 3: Installing a “cool” third-party Skill
You find a GitHub Skill claiming to “one-click deploy full-stack applications” and decide to try it. It declares 12 npm dependencies and 3 Python dependencies.
Before installation, MistEye recursively scans all dependency declaration files in the Skill directory and outputs:
🔍 Threat Intelligence Details — Skill Dependency Recursive Scan
Scan directory: awesome-fullstack-skill/
Dependency files: package.json (12 items), requirements.txt (3 items)
🚨 Detection hits (1 item):
- Target: typo-crypto@4.3.0 (package:npm)
Evidence: package.json:15
Severity: Critical
Confidence: 100%
First seen: 2026–05–06 08:12 UTC
Intelligence source: misteye_internal
Detection coverage: 14/15 dependencies scanned (1 blocked, scan terminated)
Passed: 13
Matched: 1
Incomplete: 1 (terminated due to block)
⛔ Malicious dependency detected. Skill installation blocked entirely.
Even if only one out of fifteen dependencies is malicious, the entire installation is blocked — not “warned but installed anyway.”
Scenario 4: A Skill installed yesterday gets flagged today
Yesterday you installed a data processing Skill; all 15 dependencies passed pre-install checks. Today, during the scheduled daily inspection, you receive this alert:
🚨 High-Risk Dependency Patrol Alert
🔍 Coverage
Installed directories: 8
Scanned directories: 8
Dependency files: 23
Successfully parsed: 23
Coverage status: OK
🚨 Detection hits (1 item):
- Target: jwrincident==1.0.1 (package:pypi)
Source: my-data-skill/requirements.txt:3
Severity: Critical
Confidence: 100%
First seen: 2026–05–09 02:15 UTC
Intelligence source: misteye_internal
[high-risk dependency patrol alert]
⚠️ This dependency has been flagged as malicious. Please manually review and pause related Skill installation/access.
Something safe at install time is not guaranteed to remain safe. Threat intelligence evolves continuously, and inspection is the mechanism that “looks back.”
Across all four scenarios, the core logic is consistent:
- Pre-execution detection blocks risky actions before they happen
- Daily inspection re-evaluates what was already installed
No extra workflow overhead, no behavior change — only enforcement when risk emerges.
Applicable Roles
VIII. Conclusion
MistEye Security Gate is a practical security tool introduced by the SlowMist security team for the era of AI agents. It does not pursue an all-encompassing framework narrative; instead, it focuses on a single high-frequency and high-risk scenario — pre-installation dependency security checks. By applying strict hard-blocking logic and full-coverage thresholds, it provides a reliable front-line defense for dependency security in AI agents.
In the current context of continuous expansion of AI coding tools and the Skill ecosystem, performing a security check before installing anything is a habit every developer should cultivate.
About SlowMist
SlowMist is a threat intelligence firm focused on blockchain security, established in January 2018. The firm was started by a team with over ten years of network security experience to become a global force. Our goal is to make the blockchain ecosystem as secure as possible for everyone. We are now a renowned international blockchain security firm that has worked on various well-known projects such as HashKey Exchange, OSL, MEEX, BGE, BTCBOX, Bitget, BHEX.SG, OKX, Binance, HTX, Amber Group, Crypto.com, etc.
SlowMist offers a variety of services that include but are not limited to security audits, threat information, defense deployment, security consultants, and other security-related services. We also offer AML (Anti-money laundering) software, MistEye (Security Monitoring), SlowMist Hacked (Crypto hack archives), FireWall.x (Smart contract firewall) and other SaaS products. We have partnerships with domestic and international firms such as Akamai, BitDefender, RC², TianJi Partners, IPIP, etc. Our extensive work in cryptocurrency crime investigations has been cited by international organizations and government bodies, including the United Nations Security Council and the United Nations Office on Drugs and Crime.
By delivering a comprehensive security solution customized to individual projects, we can identify risks and prevent them from occurring. Our team was able to find and publish several high-risk blockchain security flaws. By doing so, we could spread awareness and raise the security standards in the blockchain ecosystem.
