עב
עב

Agent Infra Risk Assessment

Answer twelve questions about where your AI agent runs and what it can reach, and get findings by severity, each with a recommendation and the source behind it. Scored in your browser; your answers stay in the link.

Your answers stay on this page and in the link after #, which browsers never send to a server. Nothing is stored.

Secrets

  • Which credentials can the agent read where it runs?

    Environment variables, config files, a logged-in CLI or a credential helper all count.

  • Are secret files (.env, private keys) inside the folders the agent works in?

    Including the home directory when the agent can read it: ~/.ssh, ~/.aws, ~/.kube.

Network

  • Where can the agent's environment connect to?

    Outbound connections: package registries, APIs, any website.

  • Does the agent read content that other people can write?

    Issues, pull requests from outside, web pages, emails, tickets, documentation of dependencies.

  • Does the agent's environment accept connections from outside?

    Open ports, a preview URL, a remote desktop or an exposed MCP server.

Production

  • What can the agent do in production?

    Servers, databases, clusters and cloud accounts that serve real users.

Budget and resources

  • Is there a spending limit on the accounts the agent uses?

    The model API and any cloud account the agent can create resources in.

  • Are CPU, memory, disk and run time of the agent's environment limited?

    Container or VM limits and a timeout for each task.

Environment lifetime

  • How long does the agent's environment live?

    What is left behind between tasks: files, credentials, running processes.

Human approval and identity

  • Which actions does a person approve before they happen?

    Destructive or outward actions: deleting, pushing, deploying, paying, sending messages.

  • Whose identity does the agent act with?

    The account, token or SSH key its commands and API calls are made with.

Audit

  • Are the agent's commands, tool calls and changes recorded?

    Enough to answer later what the agent did, when, and with which credentials.

Result

This is a self-assessment built from your answers, not a scan of your infrastructure, a security audit or a compliance certification. The recommendations are general practices with their sources; check them against your own setup.

0 of 12 questions answered.

Risk score
Answer a question to see the score.
Highest severity
No risky answer

The share of the riskiest possible answers over the questions you answered. The findings below matter more than the number.

Findings and recommendations

Error0
High0
Medium0
Low0
Info1

1 findings: 0 error, 0 high, 0 medium, 0 low, 1 info.

Info1

  1. InfoAQ-AGR-900

    12 question(s) were not answered; the score counts only the answered ones.

Report

agent-infra-risk-assessment.md
# Agent Infra Risk Assessment

Risk score: no question answered yet

0 of 12 questions answered.

This is a self-assessment built from your answers, not a scan of your infrastructure, a security audit or a compliance certification. The recommendations are general practices with their sources; check them against your own setup.

Source: https://anaroq.com/agents/risk-assessment

## Answers

### Secrets

- Which credentials can the agent read where it runs? **Not answered**
- Are secret files (.env, private keys) inside the folders the agent works in? **Not answered**

### Network

- Where can the agent's environment connect to? **Not answered**
- Does the agent read content that other people can write? **Not answered**
- Does the agent's environment accept connections from outside? **Not answered**

### Production

- What can the agent do in production? **Not answered**

### Budget and resources

- Is there a spending limit on the accounts the agent uses? **Not answered**
- Are CPU, memory, disk and run time of the agent's environment limited? **Not answered**

### Environment lifetime

- How long does the agent's environment live? **Not answered**

### Human approval and identity

- Which actions does a person approve before they happen? **Not answered**
- Whose identity does the agent act with? **Not answered**

### Audit

- Are the agent's commands, tool calls and changes recorded? **Not answered**

## Findings and recommendations

No risky answer was found.

### Info (1)

- **AQ-AGR-900** 12 question(s) were not answered; the score counts only the answered ones.

---

Engine: @anaroq/agents/risk 1.0.0, questionnaire agent-infra-risk v1

Hand off to an agent

A Markdown task for a coding agent: the files, the findings, the limits and fixed guardrails. Values that look like secrets are masked. It is built on this page and sent nowhere.

How the agent handoff works

What it does

A structured self-assessment for a team that runs a coding or operations agent against its own infrastructure: what the agent can read, where it can connect, what it can change in production, what limits its spending and resources, how long its environment lives, what a person approves, and what is recorded.

Each risky answer is a finding with a severity, a recommendation and its source: the OWASP Top 10 for LLM Applications, OWASP cheat sheets or the documentation of the coding agents. Some answers are riskier together, such as secrets, untrusted input and an open network; those are findings of their own.

  • Secrets
  • Network
  • Production
  • Budget and resources
  • Environment lifetime
  • Human approval and identity
  • Audit

How it works

  1. Answer for one agent and one environment. Skip a question you do not know; the score counts only the answered ones and says how many are open.
  2. Each answer has a fixed weight from 0 to 3, and its severity follows from it: 1 is low, 2 medium, 3 high. The score is the share of the riskiest possible answers over the questions you answered, from 0 to 100. The same answers always give the same findings and score.
  3. Your answers go into the link after #, never to a server. Copy the link to continue later or to compare setups, download the report as Markdown, or hand the findings to a coding agent to review with you.

Example

A coding agent on a developer's laptop with the developer's own keys and an open network, assessed by the same engine at build time:

Score: 58 of 100, 13 findings.

agent-infra-risk-assessment.md
# Agent Infra Risk Assessment

Risk score: 58 of 100

12 of 12 questions answered.

This is a self-assessment built from your answers, not a scan of your infrastructure, a security audit or a compliance certification. The recommendations are general practices with their sources; check them against your own setup.

Source: https://anaroq.com/agents/risk-assessment

## Answers

### Secrets

- Which credentials can the agent read where it runs? **Long-lived keys or tokens with a broad scope**
- Are secret files (.env, private keys) inside the folders the agent works in? **Yes, but the agent's permissions deny reading them**

### Network

- Where can the agent's environment connect to? **Anywhere on the internet**
- Does the agent read content that other people can write? **Yes**
- Does the agent's environment accept connections from outside? **No**

### Production

- What can the agent do in production? **Read only**

### Budget and resources

- Is there a spending limit on the accounts the agent uses? **Only alerts**
- Are CPU, memory, disk and run time of the agent's environment limited? **No**

### Environment lifetime

- How long does the agent's environment live? **Kept and never reset (for example a developer's laptop)**

### Human approval and identity

- Which actions does a person approve before they happen? **Some of them**
- Whose identity does the agent act with? **A person's account and tokens**

### Audit

- Are the agent's commands, tool calls and changes recorded? **Yes, on the same machine the agent runs on**

## Findings and recommendations

### High (2)

- **AQ-AGR-003** The agent's environment can connect anywhere, so data can leave and untrusted code can come in.
  - Recommendation: Block outbound traffic by default and allow only the registries and APIs the task needs, at the network or sandbox level.
  - Source: https://code.claude.com/docs/en/sandboxing
  - On ANAROQ: [Agent Permissions Generator](https://anaroq.com/agents/permissions-generator)
- **AQ-AGR-101** The agent holds secrets, reads untrusted text and can connect anywhere: injected instructions can make it send the secrets out.
  - Recommendation: Break the combination: remove the secrets, the untrusted input or the open network from this agent; any one of them is enough.
  - Source: https://genai.owasp.org/llmrisk/llm01-prompt-injection/
  - On ANAROQ: [Agent Permissions Generator](https://anaroq.com/agents/permissions-generator)

### Medium (7)

- **AQ-AGR-001** The agent can read long-lived, broadly scoped keys. A leak stays useful until someone revokes them.
  - Recommendation: Give the agent short-lived, narrowly scoped credentials for a non-production account, and keep production secrets in a secret manager it cannot read.
  - Source: https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
  - On ANAROQ: [Agent Permissions Generator](https://anaroq.com/agents/permissions-generator)
- **AQ-AGR-004** The agent reads text other people can write. Instructions hidden in it (prompt injection) can steer what the agent does.
  - Recommendation: Treat that content as data: give the agent that reads it fewer tools and no secrets, and ask a person before any action it proposes.
  - Source: https://genai.owasp.org/llmrisk/llm01-prompt-injection/
  - On ANAROQ: [Agent Permissions Generator](https://anaroq.com/agents/permissions-generator)
- **AQ-AGR-008** The agent's CPU, memory, disk and run time are not limited, so a runaway task can starve the machine.
  - Recommendation: Run the agent in a container or VM with CPU, memory and disk limits, and stop each task after a timeout.
  - Source: https://genai.owasp.org/llmrisk/llm102025-unbounded-consumption/
  - On ANAROQ: [AI agent workload sizer: vCPU, RAM, disk and GPU](https://anaroq.com/tools/agent-workload-sizer)
- **AQ-AGR-009** The environment is never reset: credentials, files and changes from every task accumulate there.
  - Recommendation: Give each task a fresh environment, such as a container or a development container, and delete it when the task ends.
  - Source: https://code.claude.com/docs/en/devcontainer
- **AQ-AGR-010** Only some risky actions need a person's approval; the others happen as soon as the agent decides.
  - Recommendation: Require a person's approval for every destructive or outward action: deleting, pushing, deploying, paying and sending.
  - Source: https://genai.owasp.org/llmrisk/llm062025-excessive-agency/
  - On ANAROQ: [Agent Permissions Generator](https://anaroq.com/agents/permissions-generator)
- **AQ-AGR-011** The agent acts as a person, so its actions are indistinguishable from theirs and carry all of their access.
  - Recommendation: Give the agent its own account or token with only the permissions the task needs, so its actions can be told apart and revoked.
  - Source: https://genai.owasp.org/llmrisk/llm062025-excessive-agency/
- **AQ-AGR-103** Strong credentials stay in an environment that is never reset, so they outlive the task that needed them.
  - Recommendation: Issue the credentials per task and revoke them when it ends, or move the agent to an environment that is deleted after each task.
  - Source: https://genai.owasp.org/llmrisk/llm022025-sensitive-information-disclosure/

### Low (4)

- **AQ-AGR-002** Secret files sit next to the agent's work, protected only by its permission rules. A shell command can still read them.
  - Recommendation: Move `.env` files and keys out of the workspace, deny them in the agent's permissions, and run the agent where your home directory is not mounted.
  - Source: https://code.claude.com/docs/en/permissions
  - On ANAROQ: [Agent Permissions Generator](https://anaroq.com/agents/permissions-generator)
- **AQ-AGR-006** The agent can read production. Reads can still expose customer data or load a database.
  - Recommendation: Keep the agent out of production: let it propose changes through a pull request and a pipeline that a person approves.
  - Source: https://genai.owasp.org/llmrisk/llm062025-excessive-agency/
  - On ANAROQ: [Agent Permissions Generator](https://anaroq.com/agents/permissions-generator)
- **AQ-AGR-007** Spending raises alerts but does not stop. A loop overnight is billed before anyone reads them.
  - Recommendation: Set a hard spending limit on the model API key and the cloud account the agent uses, and keep alerts on top of it.
  - Source: https://genai.owasp.org/llmrisk/llm102025-unbounded-consumption/
  - On ANAROQ: [AI agent workload sizer: vCPU, RAM, disk and GPU](https://anaroq.com/tools/agent-workload-sizer)
- **AQ-AGR-012** The record is kept where the agent runs, so the agent, or whatever took it over, can change or delete it.
  - Recommendation: Record the agent's commands, tool calls and changes, and send the record to a place the agent cannot write to.
  - Source: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html

---

Engine: @anaroq/agents/risk 1.0.0, questionnaire agent-infra-risk v1

Limits

This is a self-assessment built from your answers, not a scan of your infrastructure, a security audit or a compliance certification. The recommendations are general practices with their sources; check them against your own setup.

  • It scores your answers, not your infrastructure: nothing is scanned or connected to, and a wrong answer gives a wrong result.
  • It is not a security audit, a penetration test or a compliance certification.
  • The weights are a fixed, published model; your own risks may weigh differently. Read the findings, not only the score.
  • The recommendations are general practices. Check each one against your agent's documentation and your own setup before you change anything.

Methodology: how the numbers are worked out

Sources

  1. OWASP Top 10 for LLM Applications 2025: LLM01 Prompt Injection
  2. OWASP Top 10 for LLM Applications 2025: LLM02 Sensitive Information Disclosure
  3. OWASP Top 10 for LLM Applications 2025: LLM06 Excessive Agency
  4. OWASP Top 10 for LLM Applications 2025: LLM10 Unbounded Consumption
  5. OWASP Cheat Sheet: Secrets Management
  6. OWASP Cheat Sheet: Logging
  7. Claude Code Docs: Security
  8. Claude Code Docs: Configure permissions
  9. Claude Code Docs: Sandboxing
  10. Claude Code Docs: Development containers
  11. Claude Code Docs: Monitoring

Updated

Next step

Agent Permissions Generator

A free public tool by ANAROQ, a company building compute infrastructure. What ANAROQ is building