Audit AI Agent Plugins with tessl-audit

What you’ll get

A quick security and quality report on the plugins your AI agent uses. Plugins (also called “skills”) give an AI agent extra abilities, but a badly written or malicious one can leak data or give bad guidance. tessl-audit scans them and tells you which are safe, which are risky, and which have no proof they actually help, so you are not trusting them on vibes.

Tools you need

• tessl-audit (free): a command-line tool that scans an AI agent’s plugins for security, quality, and performance.
• npm (free): the standard installer for JavaScript tools. It comes bundled with Node.js, which you install once. (“npm” runs a tool you have installed; “npx” runs one without a permanent install.)

This workflow assumes you already have a Tessl project, that is, a folder with a tessl.json file describing your agent’s plugins. If you do not, this tool has nothing to audit.

Steps

1. Install Node.js (which includes npm): download it from nodejs.org and run the installer for your system. To confirm it worked, run this in your terminal:

   node -v

   You should see a version number printed, which means Node and npm are ready.

2. Install tessl-audit: install it once, available everywhere on your machine (that is what -g, “global”, means):

   npm install -g tessl-audit

   You should see install logs ending in success.

3. Go to your project folder: in the terminal, move into the root of your Tessl project (the folder that contains tessl.json):

   cd path/to/your-tessl-project

4. Run the audit: from that folder, run:

   npx tessl-audit

   Within about 30 seconds you should see a report covering your project’s plugins, with warnings and a “security posture” summary (an overall safety rating).

5. Read the security findings: each flagged plugin gets a status, Advisory (minor note), Risky, or Critical, plus a link to its full report. Start with anything marked Critical or Risky.

6. Check the quality scores: a plugin scoring below 80% means its guidance is likely incomplete or poorly structured, so the agent may misuse it. Note which ones fall short.

7. Look at “uplift” data: uplift means proof a plugin actually improves the agent’s results. If a plugin has none, you genuinely do not know whether it helps or hurts.

8. Act on the recommendations: the report suggests next steps, such as optimizing a plugin or generating tests. For a plugin with no uplift data, the suggested tessl scenario generate and tessl eval run commands create test scenarios and measure its real impact.

Original source

Based on a post by tessl-io on the DEV Community blog arguing that AI agent plugins should be audited rather than trusted blindly, and introducing tessl-audit to check them for security and performance.

Notes & variations

• Free-tier viability: the whole workflow uses free, open-source tools and almost no data.
• Common pitfall: running the audit from the wrong folder. If you are not in the directory that holds tessl.json, the tool cannot find your project and the report fails.
• Tip for better results: do not stop at the security status. Use the uplift commands to measure whether each plugin earns its place, so you keep the ones that help and drop the ones that just add risk.