sage

Name: sage
Author: avast

Verified

Lightweight Agent Detection & Response (ADR) layer for AI agents — guards commands, files, and web requests. Part of Gen Agent Trust Hub.

135stars

6forks

TypeScript

Installation

# Add to your Claude Code skills
git clone https://github.com/avast/sage

Getting Started

Guides for using ai agents skills like sage.

Caveman: Cut Claude Token Use by 65%
How agent-side prompt compression works, when to use it, and when not to.
What is an AI Skills Marketplace?
Definitions, how marketplaces work, and how to choose between them in 2026.
Getting Started with AI Skills

Security ReportVerified

Last scanned: 5/30/2026

{
  "issues": [],
  "status": "PASSED",
  "scannedAt": "2026-05-30T16:19:02.836Z",
  "npmAuditRan": true,
  "pipAuditRan": true
}

README.md

Frequently Asked Questions

What is sage?

sage is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by avast. Lightweight Agent Detection & Response (ADR) layer for AI agents — guards commands, files, and web requests. Part of Gen Agent Trust Hub. It has 135 GitHub stars.

Is sage safe to use?

Yes. sage passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.

How do I install sage?

Clone the repository with "git clone https://github.com/avast/sage" and add it to your Claude Code skills directory (see the Installation section above).

What programming language is sage written in?

sage is primarily written in TypeScript. It is open-source under avast on GitHub, so you can review or fork the full source.

Are there alternatives to sage?

Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh sage against similar tools.

Agentic AI for Beginners

Build your first AI agent from scratch - tool use, ReAct pattern, memory, deployment

41 minBeginner

Comments (0)

to leave a comment.

No comments yet. Be the first to share your thoughts!

Related Skills

ECC

by affaan-m

The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.

255,402

rust-docs-mcp satori

⚠️ Third-Party Software Notice

This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.

Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.

Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.

Read the Terms of Service

Sage

Safety for Agents - a lightweight Agent Detection & Response (ADR) layer for AI agents that guards commands, files, and web requests.

Sage intercepts tool calls (Bash commands, URL fetches, file writes) via hook systems in Claude Code, Cursor / VS Code, OpenClaw, and OpenCode, and checks them against:

URL reputation - cloud-based malware, phishing, and scam detection
Local heuristics - YAML-based threat definitions for dangerous patterns
Package supply-chain checks - registry existence, file reputation, and age analysis for npm/PyPI packages
Plugin scanning - scans other installed plugins for threats at session start

Quick Start

Claude Code

Requires Node.js >= 18.

/plugin marketplace add https://github.com/avast/sage.git
/plugin install sage@sage

Cursor

Build and install the extension, then run Sage: Enable Protection from the command palette.

pnpm install && pnpm -C packages/extension run package:cursor:vsix

OpenClaw

# From npm (recommended)
openclaw plugins install @gendigital/sage-openclaw

# From source
pnpm install && pnpm build
cp -r packages/openclaw sage && openclaw plugins install ./sage

OpenCode

Use a local source checkout and add the plugin path in OpenCode config:

git clone https://github.com/avast/sage
cd sage
pnpm install
pnpm --filter @sage/opencode run build

{
  "plugin": ["/absolute/path/to/sage/packages/opencode"]
}

See Getting Started for detailed instructions.

Documentation

Document	Description
Getting Started	Installation for all platforms
How It Works	Detection layers, data flow, verdicts
Configuration	All config options and file paths
Threat Rules	YAML rule format and what gets checked
Package Protection	npm/PyPI supply-chain checks
Plugin Scanning	Session-start plugin scanning
AMSI Scanning	Windows antimalware scanning via AMSI
Architecture	Monorepo structure, packages, design decisions
Development	Building, testing, tooling, conventions
FAQ	Common questions
Privacy	What data is sent, what stays local

Platform guides: Claude Code · Cursor / VS Code · OpenClaw · OpenCode

Current Limitations

MCP tool call interception (mcp__*) is not yet implemented
Custom user threat definitions (~/.sage/threats/) are not yet implemented

Privacy

Sage sends URL hashes and package hashes to Gen Digital reputation APIs. File content, commands, and source code stay local. Both services can be disabled for fully offline operation. See Privacy for details.

Contributing

See CONTRIBUTING.md for development setup, coding conventions, and the threat rule contribution process.

License

Source code: Apache License 2.0
Threat detection rules (threats/): Detection Rule License 1.1