Skill Security is the ingestion-checkpoint organ of the ImmuneWorks immune mesh. Before any skill or MCP tool reaches your AI agent, a two-engine quarantine — static rules plus a real eBPF execution sandbox — intercepts prompt injection, data exfiltration and supply-chain poisoning.
Skills and MCP tools are what an agent ingests — they arrive with executable scripts, network egress and file access. Public-corpus research: 26.1% of skills contain vulnerabilities, 5.2% show malicious intent, and skills with executable scripts are 2.12× more likely to be dangerous. EDR / NDR can't see what a skill actually does inside an agent.
A one-click install grants tool, file and network access with almost no review — trust is granted by default.
An MCP tool's description looks harmless while its code exfiltrates after install; dependencies hide known CVEs.
Hidden instructions override the system prompt and coax the agent into sending context and credentials out — cross-file, encoded, invisible to keywords.
ImmuneWorks splits the enterprise AI immune system into cooperating organs that together deliver AIDR (AI Detection & Response). Skill Security holds the frontline layer — the mucosal barrier between your agent and the external skill supply chain.
Just as the mucosal barrier screens matter before it enters the bloodstream, Skill Security quarantines every skill / MCP before it enters the agent runtime: the suspicious go to an isolated sandbox, honeypot decoys watch behavior, confirmed-malicious are blocked, and only the clean pass. It turns pre-install review into a default step in the agent workflow, not an after-the-fact audit.
Each skill passes through four immune stages. No stage convicts alone — only corroborating evidence escalates to a confirmed threat.
116 rules + YARA signatures + taint tracking + bytecode analysis, resolving data flow across files at high recall.
Docker + Tetragon eBPF really execute the skill, capturing syscall / network / file behavior; honeypot decoys trap credential theft.
Static and dynamic hits on the same category escalate to critical; an LLM pass filters false positives and flags description-behavior mismatch.
SARIF / Markdown / JSON reports, a CI exit-code gate and an MCP install gate wire the verdict into your workflow.
From prompt injection to MCP tool poisoning — quarantine covers the full threat family across the agent skill supply chain, each finding carrying a rule_id, category and remediation.
Skill Security is 100% self-hostable; skill content never leaves your perimeter. Pick the integration point that fits your flow.
skillsec scan locally; a pre-commit hook blocks before code lands.
SARIF 2.1.0 uploads to GitHub Code Scanning; exit-code gates by severity.
Embed as an MCP tool; quarantine inline before a skill installs, allow or block on the verdict.
A platform registry, allowlist, alerts and audit — one verdict shared across the team.
The Tetragon eBPF sandbox ships with your cluster; dynamic quarantine runs entirely inside your environment.
Verdict signals flow back to the immune mesh, sharing IOCs and threat intel with the other organs.
Bring your skill or MCP repo; we'll show the static + sandbox engines quarantine and block, live, on real samples.