Formal Analysis and Supply Chain Security for Agentic AI Skills

Researchers developed SkillFortify, the first formal analysis framework for securing AI agent skill supply chains, addressing critical vulnerabilities exposed by attacks like ClawHavoc that infiltrated over 1,200 malicious skills. The framework achieved 96.95% F1 score with 100% precision and zero false positives in detecting malicious AI agent skills.

• →The ClawHavoc campaign successfully infiltrated over 1,200 malicious skills into major AI agent marketplaces, exposing critical supply chain vulnerabilities.
• →SkillFortify is the first formal analysis framework specifically designed for AI agent skill supply chain security.
• →The framework achieved exceptional performance with 96.95% F1 score, 100% precision, and 0% false positive rate on 540 test skills.
• →Existing security tools for AI agent skills rely on heuristic methods without formal guarantees, creating security gaps.
• →The research introduces six key innovations including the DY-Skill attacker model and capability-based sandboxing with formal proofs.