skillfortify

> Supply chain security scanner for AI agent skills -- supports 22 frameworks.
SkillFortifyBench Now Available
**540-skill benchmark** for evaluating scanners of AI agent skill supply chains. 270 malicious (13 attack types) + 270 benign (5 categories), across the three surfaces an agent loads from: Claude Code and OpenClaw skills (SKILL.md under each runtime's install path) and MCP server configs. Deterministic from seed=42, with a mechanical check that no structural feature of a specimen predicts its label. **View Benchmark** | **Standalone Repo**
---
**Website** | **PyPI** | **Paper (arXiv)** | **Wiki** | **Varun Pratap Bhardwaj** · @varunPbhardwaj
---
One Command. Every Framework.
SkillFortify formally analyzes agent skill safety using sound static analysis. If SkillFortify reports no violations, the capability bounds in the formal model are assured. Unlike heuristic scanners where absence of findings does not mean absence of risk, SkillFortify provides mathematically grounded security guarantees.
---
Supported Frameworks (22)
| # | Framework | Detection |
|---|-----------|-----------|
| 1 | **Claude Code Skills** | .claude/ directory |
| 2 | **MCP Servers** | mcp.json, mcp_config.json, deep server scan |
| 3 | **OpenClaw Skills** | .openclaw/skills/ directory |
| 4 | **LangChain Tools** | langchain imports, BaseTool, @tool |
| 5 | **CrewAI Tools** | crew.yaml, crewai imports |
| 6 | **AutoGen Tools** | autogen imports, register_for_llm |
| 7 | **OpenAI Agents SDK** | openai-agents configurations |
| 8 | **Google ADK** | google-adk configurations |
| 9 | **Dify** | Dify workflow and plugin definitions |
| 10 | **Composio** | Composio tool integrations |
| 11 | **Semantic Kernel** | Microsoft Semantic Kernel plugins |
| 12 | **LlamaIndex** | LlamaIndex tool abstractions |
| 13 | **n8n** | n8n workflow node definitions |
| 14 | **Flowise** | Flowise chatflow configurations |
| 15 | **Mastra** | Mastra agent tool definitions |
| 16 | **PydanticAI** | PydanticAI tool decorators |
| 17 | **Agno** | Agno agent configurations |
| 18 | **CAMEL-AI** | CAMEL-AI tool integrations |
| 19 | **MetaGPT** | MetaGPT action and tool definitions |
| 20 | **Haystack** | Haystack component definitions |
| 21 | **Anthropic Agent SDK** | Anthropic agent tool configurations |
| 22 | **Custom Skills** | User-defined skill manifests (YAML/JSON) |
All frameworks are parsed into a unified representation for consistent analysis, trust scoring, and SBOM generation.
---
Quick Start
Install
System-Wide Scan
Run skillfortify scan with no arguments to automatically discover every AI agent tool installed on your system -- Claude Code, Cursor, VS Code extensions, Windsurf, and more:
Project Scan
HTML Dashboard
Generate a standalone HTML security report with interactive filtering, a capabilities matrix, and severity breakdown:
Open the generated file in any browser -- no server or dependencies required.
---
Features
- **Formal threat model (DY-Skill)** -- mathematically grounded attack taxonomy for the agent skill supply chain
- **Sound static analysis** -- formal capability verification, not heuristic pattern matching
- **Capability-based access control** -- POLA compliance checks for every skill
- **Agent Dependency Graph** -- constraint-based resolution with conflict detection
- **Lockfile generation** -- deterministic skill-lock.json for reproducible agent configurations
- **Trust score algebra** -- multi-signal trust with propagation through dependency chains
- **ASBOM generation** -- CycloneDX 1.6 Agent Skill Bill of Materials for compliance reporting
- **Registry scanning** -- scan MCP registries, PyPI, and npm for known vulnerabilities