ai · security · skills
MaturitySkillsDemo
Tools

SkillGuard · AI skill supply-chain security

Admit only the skillsthat keep you on course.

SkillGuard reads every AI skill before you run it: what it can do, what it touches, and where a chain of harmless-looking skills becomes a data-exfiltration path. Below is the literal output on a real public repo, not an example. The practitioner door names the skills this discipline asks you to acquire.

56 skills scanned. Watch the verdict land.Scanning
applying-zero-trust-to-ai-workloads2 cap
generating-an-ai-bill-of-materials1 cap
assessing-jailbreak-resistance-pre-deployment1 cap
red-teaming-llm-applications1 cap
assessing-third-party-model-and-provider-risk—
scanning-ai-bom-for-vulnerable-components1 cap
bounding-agent-autonomy-and-tool-scopes-least-privilege—
56
Skills read
—
Findings
—
Left open

Read: Every skill is read before anything runs — capabilities extracted, nothing executed.

0
RISKS LEFT OPEN

We scanned 56 public skills. Every finding is triaged and resolved.

This is the literal output of our own scanner run against a real public repository — not an illustration.

56
SKILLS SCANNED
56
FILES SCANNED
3
FINDINGS RAISED
3
TRIAGED, REASON GIVEN
0
OUTSTANDING
WHAT SKILLGUARD CHECKS
Prompt injection
Instructions hidden in a skill that try to hijack the model once it runs.
Download-and-run installers
Skills that fetch and execute an external tool — the classic supply-chain risk.
Risky capabilities & combinations
What each skill can touch — network, secrets, files — and where two safe skills chain into an exfiltration path.
THE FINDINGS · ALL 3 TRIAGED
Download-execute installer chain
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh
✓Verdict: Documented install command for Anchore Syft, the SBOM generator this skill teaches you to run — matches the skill's own stated purpose, not an unexplained fetch-and-execute.
Prompt-injection / instruction-override phrasing
Ignore previous instructions
✓Verdict: Quoted verbatim as the worked attack-phrase example this red-teaming skill teaches testers to probe with — the skill's job is to teach exactly this phrase, not to execute it.
Download-execute installer chain
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh
✓Verdict: Documented install command for Anchore Grype, the vulnerability scanner this skill teaches you to run against an AI-BOM — same legitimate-tool pattern as the Syft finding above.
THE RAW DETAIL
OBSERVED CAPABILITIES · ACROSS 56 PUBLIC SKILLS
package-install
0
filesystem-write
0
secret-access
0
network
0
shell
0
filesystem-read
0
git-write
0
PER-SKILL RISK · SCROLL FOR ALL 56
applying-zero-trust-to-ai-workloads2 cap · risk 0
assessing-jailbreak-resistance-pre-deployment1 cap · risk 0
assessing-third-party-model-and-provider-risk— · risk 0
bounding-agent-autonomy-and-tool-scopes-least-privilege— · risk 0
building-an-ai-incident-response-playbook1 cap · risk 0
building-an-ai-risk-register1 cap · risk 0
capturing-agent-action-and-delegation-telemetry— · risk 0
classifying-ai-systems-under-eu-ai-act— · risk 0
completing-the-ai-caiq-self-assessment2 cap · risk 0
conducting-adversarial-robustness-testing2 cap · risk 0
conducting-an-aicm-control-assessment1 cap · risk 0
defending-against-prompt-injection— · risk 0
deploying-llm-output-guardrails1 cap · risk 0
designing-ai-service-failover-and-resilience1 cap · risk 0
detect-mcp-adversarial-input-corpus— · risk 0
detect-mcp-model-artifact-tampering— · risk 0
detect-mcp-model-token-flood1 cap · risk 0
detect-mcp-plugin-supply-chain— · risk 0
detect-mcp-shadow-tool-injection— · risk 0
detect-mcp-tool-drift— · risk 0
detect-mcp-unbounded-tool-output— · risk 0
detect-prompt-injection-mcp-proxy— · risk 0
detect-system-prompt-extraction— · risk 0
detect-tool-output-exfiltration-instructions— · risk 0
detecting-cascading-and-feedback-loop-agent-behavior— · risk 0
detecting-deepfake-audio-in-vishing-attacks— · risk 0
detecting-prompt-injection-and-jailbreak-attempts1 cap · risk 0
enabling-model-and-data-portability-and-export1 cap · risk 0
establishing-ai-acceptable-use-and-developer-training— · risk 0
evaluating-model-safety-bias-and-harm2 cap · risk 0
fitting-ai-triage-to-known-noise-sources— · risk 0
generating-an-ai-bill-of-materials1 cap · risk 12
governing-ai-coding-assistant-endpoints1 cap · risk 0
hardening-agent-orchestration-against-drift— · risk 0
implementing-content-safety-output-filtering— · risk 0
implementing-kill-switch-and-rollback-for-autonomous-agents— · risk 0
implementing-on-behalf-of-delegation-and-consent2 cap · risk 0
implementing-permission-aware-retrieval-for-rag2 cap · risk 0
implementing-prompt-and-response-logging— · risk 0
investigating-compromised-ai-agent-credentials1 cap · risk 0
isolating-ai-training-clusters— · risk 0
managing-agent-credential-rotation-and-revocation1 cap · risk 0
mapping-controls-to-iso-420011 cap · risk 0
monitoring-model-drift-and-degradation1 cap · risk 0
protecting-model-artifacts-with-key-management— · risk 0
provisioning-non-human-identities-for-ai-agents1 cap · risk 0
red-teaming-llm-applications1 cap · risk 25
scanning-ai-bom-for-vulnerable-components1 cap · risk 12
scanning-training-and-grounding-data-for-pii2 cap · risk 0
scoping-mcp-tool-authorization-least-privilege— · risk 0
securing-mcp-server-and-tool-boundaries2 cap · risk 0
securing-rag-pipelines-against-data-leakage— · risk 0
validating-training-data-provenance-and-lineage2 cap · risk 0
verifying-model-integrity-and-provenance-signing3 cap · risk 0
verifying-open-model-supply-chain-integrity4 cap · risk 0
versioning-models-and-system-prompts-with-rollback3 cap · risk 0

Scanned 56 public skills at github.com/binu8/aisecskills-reference@0be309e. Reproduce it: python3 tools/gen_reference_skillbom.py.

Go deeper

How the scan actually works — capability extraction, the detection patterns, triage discipline, and how skill combinations become attack chains — lives on the method page. The practitioner story around it is one page up. See the scan methodology →