Home

Before You Install That AI Skill, Run This Checklist

Eight popular scanners already missed it. Here's what actually catches a malicious AI agent skill before it reaches production — built for ASEAN engineering teams shipping fast under real compliance deadlines.

Get the Checklist
The Real Threat

It Wasn't a Zero-Day. It Was a Four-Star Plug-in.

Your AI coding agent didn't get compromised by a sophisticated exploit. It got compromised by a marketplace skill with a convincing name and a polished README. The attack surface is hiding in plain sight — and your static scanner is likely missing it.

Why Now

The Fastest-Growing Unvetted Attack Surface in Enterprise Software

8

Scanners Bypassed

Popular static tools failed against basic obfuscation in controlled tests

30min

Review Time

This checklist takes thirty minutes — before any skill touches production

3

Regulators Watching

MAS, BNM, and OJK auditors will ask these questions — answer them first

Marketplace skills for AI agents are proliferating faster than security teams can review them. The problem isn't a lack of tooling — it's that existing tools weren't built for this threat model.

Built for ASEAN

Designed for Mid-Market Teams in Singapore, Malaysia, and Indonesia

This isn't a US-centric compliance template retrofitted for the region. Ewashi built this checklist specifically for engineering and security teams operating under MAS TRM, BNM RMiT, and OJK POJK 11 frameworks — where moving fast and staying compliant aren't optional trade-offs.

Checklist Preview

Four Areas the Checklist Covers

Permission Scoping

Does this skill request access it shouldn't need? Identify over-permissioned agents before they reach your environment.

Provenance Checks

Who actually published this skill? Verify maintainer identity, commit history, and dependency chain integrity.

Behavioural Red Flags

Dynamic checks that catch obfuscated payloads and unexpected network calls static scanners routinely miss.

Auditor-Ready Questions

The exact questions your MAS, BNM, or OJK auditor will eventually ask — answered before they arrive.

Why Static Scanners Keep Failing

Static analysis was built for known malware signatures. AI agent skills introduce a different threat model — logic that is contextually malicious only when executed inside your specific environment, with your specific credentials and data access.

Obfuscation at install time

Malicious logic hidden behind base64 or dynamic imports passes most signature checks cleanly.

Delayed execution

Payloads that activate only after a time delay or specific trigger evade sandbox testing.

Trusted dependency chains

Compromised upstream packages inherit trust scores from the legitimate parent skill.

Compliance Context

What Your Regional Regulators Are Already Asking

Regulatory timelines are accelerating. Engineering teams that treat compliance as a post-launch concern are inheriting audit risk that could have been resolved in thirty minutes at install time.

About Ewashi

Built by Ewashi for Teams Who Need to Move Fast Without Inheriting Someone Else's Breach

Ewashi runs adversarial assessments for mid-market engineering and security teams across Singapore, Malaysia, and Indonesia. We specialise in the gaps between what your existing tooling covers and what your actual threat surface looks like — including everything your AI agents can already reach.

Get the Checklist

Thirty Minutes Between You and a Cleaner Deployment

Fill in your details below. The checklist ships immediately. No drip campaign, no lock-in — just the review process your team needs before the next skill goes live.

Full Name

Your first and last name

Work Email

Company email address

Company

Your organisation name

Role

Your job title or function

Country

SG / MY / ID / Other

Your Checklist Is on Its Way.

While you wait — if you want a second set of eyes on what your AI agents can already reach, Ewashi runs adversarial assessments built for exactly this gap. Most mid-market teams are surprised by what we find in the first session.