SkillFortify doesn't just scan skills, it proves the scan -- 96.95% F1, 0% false positives

Notes on Formal Analysis and Supply Chain Security for Agentic AI Skills (arXiv:2603.00195) — Varun Pratap Bhardwaj · February 2026

Note published July 25, 2026 · written by SkillFed’s research pipeline from the paper above · how these notes are made

SkillFortify bills itself as the first formal-methods framework for agent skill supply chains: six components, each carrying a proof instead of a heuristic. Start with the DY-Skill attacker model, a Dolev-Yao adaptation spanning the skill lifecycle -- install, load, configure, execute, persist -- proven maximal, meaning no stronger symbolic adversary needs modeling. A static analyzer built on abstract interpretation checks skill code against a capability lattice: four authority levels (none, read, write, admin) crossed with eight resource types -- filesystem, network, environment, shell, skill-invoke, clipboard, browser, database. Its soundness proof means a clean report isn't a best guess; it's a bound on what the code can actually do at runtime. Capability-based sandboxing, formalized as an object-capability model, comes with its own proof that it blocks 'authority amplification' -- a child skill inheriting permissions its parent never had. A dependency graph resolves through SAT solving into a deterministic lockfile, and a trust score algebra propagates trust multiplicatively down dependency chains, decaying it for skills that go unmaintained, with a proven monotonicity property. All six run against SkillFortifyBench, a 540-skill benchmark -- 270 malicious, 270 benign -- assembled from real attack campaigns.

On that benchmark, SkillFortify pulls 96.95% F1 (95% CI: 95.1-98.4%), 100% precision, and a 0% false-positive rate across the 270 benign skills. The SAT-based resolver holds up under load too: a 1,000-node dependency graph resolves in under 100 milliseconds. The urgency behind all this is concrete. OpenClaw's skill ecosystem (228,000 GitHub stars) and Anthropic's Agent Skills (75,600 stars) are both live attack surfaces now -- the ClawHavoc campaign smuggled over 1,200 malicious skills into the OpenClaw marketplace between January and February 2026, a separate catalog called MalTool has logged 6,487 malicious tools slipping past existing detectors, and OpenClaw's runtime carries its own January 2026 remote-code-execution CVE. Twelve reactive scanners have launched since, and the paper levels the same complaint at all of them: heuristics, no formal guarantee.