SkillFortify
AI Agent Skill Security Formal Verification Framework
SkillFortify is a formal verification framework for AI agent skill security, released in March 2026 by Varun Pratap Bhardwaj of Qualixar. Similar to how LLMs like GPT or Claude process text, SkillFortify mathematically proves the permission scope of skills and plugins used by an agent, thereby assessing its safety. At its core is the DY-Skill threat model, which first applies the Dolev-Yao attacker model to the agent skill domain. It verifies whether a skill violates its capabilities through abstract interpretation-based static analysis and five mathematical soundness theorems. Existing agent security approaches largely rely on runtime sandboxing or manual code review. Given the increasing reality of supply chain attacks, such as the ClawHavoc campaign, where over 1,200 skills were compromised simultaneously, post-detection methods reveal fundamental limitations. SkillFortify formally proves capability-based access control (POLA compliance) at the pre-installation stage and uses a SAT-based dependency resolver to process a 1,000-node graph within 100 milliseconds. Its key differentiator is achieving 100% precision, 94.07% recall, and 96.95% F1 score on 540 benchmark skills (SkillFortifyBench), with 0% false positives. It quantifies the verification level of skills using a four-level trust system (L0 Unsigned → L3 Formally Verified) inspired by SLSA. In a bioinformatics research environment, SkillFortify can be directly used for security auditing of multi-agent pipelines. For example, it can automatically detect and verify the skills of 22 frameworks, including Claude Code, LangChain, and CrewAI, with a single command (`skillfortify scan`), and generate an Agent SBOM (Software Bill of Materials) in CycloneDX 1.6 format, enabling the automation of regulatory compliance documentation, such as the EU AI Act (Article 15) or NIST AI RMF. Reproducible environment fixing via `skill-lock.json` contributes to ensuring research reproducibility, and pre-installation inspection of MCP, PyPI, and npm packages using the `registry-scan` command prevents contamination of the experimental environment. The average analysis time per skill is approximately 2.5 milliseconds, so embedding it in a CI/CD pipeline has almost no impact on build time.
💻 System Requirements
Not required (CPU-only static analysis — GPU not used)
The package itself requires less than 100MB; including benchmark datasets, it requires approximately 500MB.
⚡ Installation
### 4-1. Quick Start
```bash
pip install skillfortify # Core scanner
skillfortify scan # Automatically detect and verify agent skills across the entire system
```
### 4-2. Detailed Installation
```bash
# Installation with options
pip install skillfortify # Core scanner
pip install skillfortify[registry] # + Marketplace scanning (MCP/PyPI/npm)
pip install skillfortify[all] # All features
# Key CLI commands
skillfortify scan # Automatically detect and analyze skills across the entire system
skillfortify verify <skill_path> # Formally verify individual skills
skillfortify lock # Generate the skill-lock.json lock file
skillfortify trust <skill_path> # Calculate the trust score (L0~L3)
skillfortify sbom # Generate CycloneDX 1.6 ASBOM
skillfortify registry-scan <package> # Pre-install check of registry packages
skillfortify dashboard # Generate HTML security dashboard
skillfortify frameworks # Check supported frameworks and detection status
```🧬 Bio Use Cases
Multi-Agent Pipeline Security Audit
In an automated pipeline combining Claude Code, LangChain, and CrewAI, use `skillfortify scan` to perform a comprehensive check of the capability scope of all skills. Detect skills with sensitive permissions (such as file system access, network calls, and code execution) that exceed their declared scope, at approximately 2.5ms per skill. This allows for a complete audit of hundreds of skills in just a few seconds.
Automated Regulatory Compliance Documentation
For research institutions that need to comply with the EU AI Act Article 15 and NIST AI RMF, use `skillfortify sbom` to automatically generate an Agent SBOM in CycloneDX 1.6 format. Document the origin, version, and verification status of the agent's skill supply chain in a machine-readable format, reducing the time required for audits.
CI/CD Gate Integration
Add a `skillfortify batch verify` step to GitHub Actions or GitLab CI to apply an automated verification gate when new skills/plugins are added. Block the injection of malicious skills with 0% false positive rate (precision 100%) without interrupting the development workflow. Secure the verified environment with skill-lock.json to ensure deployment reproducibility.
📝 Update Notes
No update notes yet.
🧪 Related Code of Life
No related Code of Life posts yet.