AI Insight
This paper presents a formal analysis framework for verifying the security of AI agent skills (executable capabilities) and addresses supply chain vulnerabilities in agentic AI systems. The authors develop theorems with full proofs and release an open-source tool called SkillFortify for detecting malicious skills. In version 2, they corrected bibliographic errors and experimental claims, finding that pattern matching alone achieves 96.15% F1 score for malicious skill detection, while information flow analysis provided no additional detections beyond pattern matching on their test corpus.
Why it matters
As AI agents become more autonomous and execute skills from third-party sources, supply chain security becomes critical to prevent malicious code execution and data exfiltration. This work provides both theoretical foundations and practical tools for validating AI skills before deployment, addressing real vulnerabilities like authentication-token theft that have already been identified in production systems.
Understand the Science
⚠️ Preprint – Noch nicht peer-reviewed
Dieser Artikel wurde noch nicht von unabhängigen Experten begutachtet. Die Ergebnisse sind vorläufig und sollten mit Vorsicht interpretiert werden.
-cross
Abstract: 32 pages, 5 theorems with full proofs, 68 references, open-source tool: https://github.com/qualixar/skillfortify. v2: corrects the bibliography (22 entries had author lists that did not match the papers at the cited arXiv identifiers; all verified against the arXiv API and corrected, and affected authors notified) and three external claims against primary sources: MalTool reports 1,300 standalone and 5,727 embedded malicious tools, not 6,487; CVE-2026-25253 is authentication-token exfiltration via an unvalidated gatewayUrl, credited to depthfirst and fixed in 2026.1.29, not remote code execution through a crafted skill package; ClawHavoc counts are 341, later 824, and 1,184 by source and date, not “over 1,200”. All experiments re-measured against the released v0.6.0 implementation using harnesses now committed to the repository. E1/E2 unchanged (F1 96.15%). E3 reverses to a negative result: information flow analysis adds no detections over pattern matching on this corpus. The soundness theorem’s scope is stated explicitly and no longer conflated with the zero false-positive rate.
Source: Formal Analysis and Supply Chain Security for Agentic AI Skills