Show HN: An audit for AI agents headed into air-gapped networks

agent-blast-radius is an Agent Skill that reads an AI agent's codebase and reports two things: its boundary (whether anything needs or reaches the outside world, such as hosted model APIs, telemetry, start-time package or model fetches, SaaS connectors and hard-coded hosts) and its blast radius (what the agent can do inside an enclave if steered by a poisoned document, an insider or a compromised host). It writes a BLAST_RADIUS.md report with file:line evidence, matched failure patterns, OWASP agentic (ASI) ids and the smallest fix per path, backed by a deterministic, read-only, offline Python scanner that never runs the target code or prints secret values. It installs as a Claude Code plugin (2.1.275+) or manually into any Agent Skills host, and is static-only, so network policy, IAM policies, token scopes and runtime MCP tools go under "Unverifiable statically."