Skill Graph: catch attacks split across harmless-looking agent skills
Scans the combination of installed agent skills for data flows across skills that add up to an attack. Fintech AppSec teams pay.
Crowded · CoRedSkill beats per-package skill audits
Written for: Solo builder, Small startup team
Next step
Ask the CoRedSkill authors for their attack set to use as a test corpus, then call the AppSec lead at a fintech with 50+ engineers on Claude Code and ask how many third-party skills sit in their repos.
Why now
The earlier Skill Scan card checked single files for hidden instructions. This paper shows checking files one by one is not enough. Teams with dozens of copied skills need a cross-skill view: which skill reads secrets, which one talks to the network, and whether they chain. The analysis is static and needs no model, so a CLI is a few weeks of work.
What became possible
CoRedSkill builds stealthy attacks from cooperating agent skills using AST-guided injection, and each skill keeps working normally. The combined intent spans skills, so auditing them one package at a time misses it.
Two ways in
- Skill Graph CLI
Parses every installed skill's code and instructions, builds a data-flow graph across skills, and flags chains from secret sources such as env vars, keychains or wallet files to network or file-write sinks.
- Customer
- AppSec lead at a fintech running Claude Code or Codex across its engineering team
- Model
- Free CLI, paid org dashboard at about $20 per developer per month
- CI gate
Blocks any pull request that adds a skill which would complete a dangerous chain with skills already in the repo.
- Customer
- Platform engineering
- Model
- Part of the paid tier
Competition
That would make a credible open-source wedge. The paid org product would still need to offer more than PR blocking, for example allow-lists that follow skill provenance and version pinning across many repos, or alerts when an upstream skill changes. Without that, it is a feature that Snyk, Cisco or GitHub can absorb.
Full competition notes (11 competitors)
This space is crowded. The decode-and-flag CLI, the SARIF and GitHub Action gating, and the public scan report all exist already. Cisco and Snyk give theirs away for free. SkillsGuard and SkillScan already decode base64 and hex, and Mondoo covers zero-width and Unicode tricks. Snyk's ToxicSkills study and Mondoo's marketplace checks also take away the novelty of a leaderboard. The name "skillscan" is already used on PyPI and Docker Hub. Charging per private repo for a scanner will be hard when the large vendors offer one for free. The remaining opening is narrower: being measurably better at evasion-resistant decoding. A Cloud Security Alliance note from June 2026 reports that existing skill scanners were bypassed across the board (https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-agent-skill-scanner-bypass-20260610-csa/). A new entrant could focus on layered and nested decodes (ROT-n inside base64 inside prose, or instructions split across files), on running fully locally with no LLM API calls, and on publishing a public bypass benchmark that rates the other scanners. That would make a credible open-source wedge. The paid org product would still need to offer more than PR blocking, for example allow-lists that follow skill provenance and version pinning across many repos, or alerts when an upstream skill changes. Without that, it is a feature that Snyk, Cisco or GitHub can absorb.
- Cisco AI Defense skill-scanner
Open source Python scanner, installed with pip install cisco-ai-skill-scanner, for skills used by Claude Code, Codex CLI and Cursor. It combines YAML and YARA pattern rules, an LLM judge and dataflow analysis. It had about 1.8k stars as of April 2026, which makes it the default free option.
- Snyk Agent Scan
Snyk's CLI (uvx snyk-agent-scan ~/.claude/skills) checks skills for prompt injection and for malware payloads hidden in natural language. Snyk also ran the ToxicSkills study, which reportedly scanned 3,984 public skills and found flaws in 36%. That study is already a public scan report.
- SkillScan (PyPI / Docker)
CLI for SKILL.md that runs static rules (59 YARA rules), LLM behavioral prediction and a Docker sandbox with honeypot files. It outputs SARIF for GitHub code scanning. The Docker image lists detection of base64-encoded instructions, homoglyphs and zero-width characters. Its name is nearly identical to the proposed one.
- SkillsGuard
Static scanner for skill directories. It decodes base64 and hex payloads before matching patterns and produces SARIF output for CI. This is close to the core decode-then-flag idea.
- SkillGuard
CLI, library, MCP server and GitHub Action built on ten rule packs. It covers the PR-gating use case.
- Mondoo AI Agent Skill Check
Free web and CLI checker for skills from several marketplaces. It looks for hidden instructions in zero-width characters, Unicode steganography and HTML comments.
- CertiK Skill Scanner
Hosted API. Its example workflow runs on every pull request and fails the build on any verdict other than pass, which matches the GitHub App idea.
- Sentry skill-scanner skill
Free Claude Code skill that runs a deterministic scanner script, then has the agent judge intent and filter false positives.
- Superagent skill-security
Two-stage design: regex, AST, taint-tracking and YARA scanning, followed by semantic review.
- skillvet
Static skill scanner that ships a sample GitHub Actions workflow with SARIF upload.
- OpenClaw skill-scan / clawscan
Covers base64, hex, unicode encoding and string-construction obfuscation in OpenClaw skill packages.
Checked 2026-10-14
Risks
- The attack is academic so far, so buyers may wait
- Skill formats differ across agent vendors
- GitHub or the labs may ship native checks
- Static analysis produces false positives that teams learn to ignore
Best on open space and team fit; market pull is the weak point (4).
tech 6 · pull 4 · space 7 · fit 7 · build 7
Exposed
Companies that could benefit or be threatened. News and context, not investment advice.
Momentum of its main topic
Sources
Status history
- 2026-10-14 Flagged as buildable