SkillFortify

Supply chain security scanner for AI agent skills -- supports 22 frameworks.

SkillFortifyBench Now Available

540-skill benchmark for evaluating scanners of AI agent skill supply chains. 270 malicious (13 attack types) + 270 benign (5 categories), across the three surfaces an agent loads from: Claude Code and OpenClaw skills (SKILL.md under each runtime's install path) and MCP server configs. Deterministic from seed=42, with a mechanical check that no structural feature of a specimen predicts its label. View Benchmark | Standalone Repo

Website | PyPI | Paper (arXiv) | Wiki | Varun Pratap Bhardwaj · @varunPbhardwaj

One Command. Every Framework.

pip install skillfortify
skillfortify scan                # Auto-discovers all AI tools on your system
skillfortify scan ./my-project   # Scan a specific project
skillfortify dashboard           # Generate HTML security report

SkillFortify formally analyzes agent skill safety using sound static analysis. If SkillFortify reports no violations, the capability bounds in the formal model are assured. Unlike heuristic scanners where absence of findings does not mean absence of risk, SkillFortify provides mathematically grounded security guarantees.

Supported Frameworks (22)

All frameworks are parsed into a unified representation for consistent analysis, trust scoring, and SBOM generation.

Quick Start

Install

pip install skillfortify                 # Core scanner
pip install skillfortify[registry]       # + marketplace scanning
pip install skillfortify[all]            # Everything

System-Wide Scan

Run skillfortify scan with no arguments to automatically discover every AI agent tool installed on your system -- Claude Code, Cursor, VS Code extensions, Windsurf, and more:

skillfortify scan

Discovering AI tools on this system...
  Found: Claude Code skills       (12 skills in ~/.claude/skills/)
  Found: MCP servers              (8 servers in ~/.cursor/mcp.json)
  Found: VS Code MCP configs      (3 servers in ~/.vscode/mcp.json)
  Found: Windsurf MCP configs     (2 servers)

Scanning 25 skills across 4 locations...

+----------------------+--------+-----------+----------+--------------+
|       Skill          | Source |  Status   | Findings | Max Severity |
+----------------------+--------+-----------+----------+--------------+
| deploy-automation    | Claude |   SAFE    |        0 | -            |
| data-export          | Claude |  UNSAFE   |        2 | HIGH         |
| postgres-server      | MCP    |   SAFE    |        0 | -            |
| file-manager         | MCP    |  WARNING  |        1 | MEDIUM       |
+----------------------+--------+-----------+----------+--------------+
25 skills scanned | 22 safe | 2 unsafe | 1 warning | 5 total findings

Project Scan

skillfortify scan ./my-agent-project
skillfortify scan ./my-agent-project --format json
skillfortify scan ./my-agent-project --severity-threshold high

HTML Dashboard

Generate a standalone HTML security report with interactive filtering, a capabilities matrix, and severity breakdown:

skillfortify dashboard
skillfortify dashboard --output security-report.html

Open the generated file in any browser -- no server or dependencies required.

Features

• Formal threat model (DY-Skill) -- mathematically grounded attack taxonomy for the agent skill supply chain
• Sound static analysis -- formal capability verification, not heuristic pattern matching
• Capability-based access control -- POLA compliance checks for every skill
• Agent Dependency Graph -- constraint-based resolution with conflict detection
• Lockfile generation -- deterministic skill-lock.json for reproducible agent configurations
• Trust score algebra -- multi-signal trust with propagation through dependency chains
• ASBOM generation -- CycloneDX 1.6 Agent Skill Bill of Materials for compliance reporting
• Registry scanning -- scan MCP registries, PyPI, and npm for known vulnerabilities
• HTML dashboard -- standalone interactive security report
• System auto-discovery -- finds every AI tool on your machine automatically
• 22 framework support -- broadest coverage of any agent security scanner

CLI Commands

Exit Codes

Benchmark Results

Evaluated on SkillFortifyBench — 540 generated agent skills, 270 malicious and 270 benign, scanned one specimen at a time at the MEDIUM severity threshold:

The corpus is synthetic, so these measure coverage of a known catalogue of attack behaviours, not accuracy on skills collected in the wild. Two gaps are open and visible in the per-type table: dependency confusion is not detected at all and half of typosquatting is missed, both because deciding a package name is suspicious needs an index of what publicly exists.

Per-specimen records are published in benchmarks/results/, so every figure above can be recomputed without rerunning a scan. See RESULTS.md for the full breakdown and what the numbers do and do not support.

Trust Levels

Graduated trust levels inspired by the SLSA framework:

CI/CD Integration

GitHub Actions

name: Skill Security Scan
on: [push, pull_request]

jobs:
  skillfortify-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - run: pip install skillfortify
      - run: skillfortify scan . --format json
      - run: skillfortify lock . --output /tmp/fresh-lock.json

Requirements

• Python 3.11 or later
• No external services required -- runs entirely offline
• Works on Linux, macOS, and Windows

Academic Paper

"Formal Analysis and Supply Chain Security for Agentic AI Skills"

Backed by peer-reviewed research with five formal theorems and full proofs, formalizing the agent skill supply chain threat model, capability verification, trust algebra, and dependency resolution.

Read the paper on arXiv | Zenodo | DOI: 10.5281/zenodo.18787663

Contributing

Contributions welcome. See CONTRIBUTING.md for setup instructions, coding standards, and submission guidelines.

Author

Varun Pratap Bhardwaj -- Solution Architect with 15+ years in enterprise technology. Dual qualifications in technology and law (LL.B.), with a focus on formal methods for AI safety.

• ORCID: 0009-0002-8726-4289
• Contact: varun.pratap.bhardwaj@gmail.com

License

Elastic License 2.0. See LICENSE.

Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar.

Citation

@article{bhardwaj2026skillfortify,
  author    = {Bhardwaj, Varun Pratap},
  title     = {Formal Analysis and Supply Chain Security for Agentic AI Skills},
  journal   = {arXiv preprint arXiv:2603.00195},
  year      = {2026},
  doi       = {10.5281/zenodo.18787663},
  url       = {https://arxiv.org/abs/2603.00195}
}

⭐ Support This Project

If this project solves a real problem for you, please star the repo — it helps other developers discover Qualixar and signals that the AI agent reliability community is growing. Every star matters.

Part of the Qualixar AI Agent Reliability Platform

Qualixar is building the open-source infrastructure for AI agent reliability engineering. Seven products, seven peer-reviewed papers, one coherent platform. Each tool solves one reliability pillar:

Zero cloud dependency. Local-first. EU AI Act compliant.

Start here → qualixar.com · All papers on Qualixar HuggingFace