Immune Mesh · skill & supply-chain immunity

Every skill your agent ingests
gets immunized here first.

Skill Security is the ingestion-checkpoint organ of the ImmuneWorks immune mesh. Before any skill or MCP tool reaches your AI agent, a two-engine quarantine — static rules plus a real eBPF execution sandbox — intercepts prompt injection, data exfiltration and supply-chain poisoning.

100% self-hosted · 0 data egress · never trust, always quarantine
Live · immune mesh
Skill Security Other organs Blocked
100%
Detection · 295/295 true positives
0FP
False positives · 220/220 TN
5ms
Static quarantine per skill
1010
Regression corpus
Why an immune layer

Agents install capabilities they can't vet — on implicit trust.

Skills and MCP tools are what an agent ingests — they arrive with executable scripts, network egress and file access. Public-corpus research: 26.1% of skills contain vulnerabilities, 5.2% show malicious intent, and skills with executable scripts are 2.12× more likely to be dangerous. EDR / NDR can't see what a skill actually does inside an agent.

Implicit trust

Trust on install

A one-click install grants tool, file and network access with almost no review — trust is granted by default.

Supply chain

Supply-chain poisoning / rug-pull

An MCP tool's description looks harmless while its code exfiltrates after install; dependencies hide known CVEs.

Prompt · exfil

Prompt injection & exfiltration

Hidden instructions override the system prompt and coax the agent into sending context and credentials out — cross-file, encoded, invisible to keywords.

Position in the mesh

The ingestion-quarantine organ of AIDR.

ImmuneWorks splits the enterprise AI immune system into cooperating organs that together deliver AIDR (AI Detection & Response). Skill Security holds the frontline layer — the mucosal barrier between your agent and the external skill supply chain.

EDR NDR XDR AIDR · Skill & Supply Chain
Mucosal barrier · ingestion quarantine

Everything the agent takes in passes this gate first.

Just as the mucosal barrier screens matter before it enters the bloodstream, Skill Security quarantines every skill / MCP before it enters the agent runtime: the suspicious go to an isolated sandbox, honeypot decoys watch behavior, confirmed-malicious are blocked, and only the clean pass. It turns pre-install review into a default step in the agent workflow, not an after-the-fact audit.

Immune mesh · cooperating organs
  • Skill Securitythis organ · you are here
  • Runtime defenseskin & bloodstream
  • Identity & non-human credswhite cells
  • Data loss preventionlymph
  • Web3 / on-chain riskantibodies
How it works

High-recall static, real sandbox execution, then correlate to convict.

Each skill passes through four immune stages. No stage convicts alone — only corroborating evidence escalates to a confirmed threat.

/ 01

Static engine

116 rules + YARA signatures + taint tracking + bytecode analysis, resolving data flow across files at high recall.

116 rulesYARAtaint
/ 02

Dynamic sandbox

Docker + Tetragon eBPF really execute the skill, capturing syscall / network / file behavior; honeypot decoys trap credential theft.

eBPFhoneypotIOC
/ 03

Correlate & semantics

Static and dynamic hits on the same category escalate to critical; an LLM pass filters false positives and flags description-behavior mismatch.

correlationLLMVirusTotal
/ 04

Report & gate

SARIF / Markdown / JSON reports, a CI exit-code gate and an MCP install gate wire the verdict into your workflow.

SARIF 2.1CI gateREST API
skillsec — scan
$ skillsec scan ./data-sync-skill --format sarif --fail-on-severity high → static (116 rules · yara · taint) ……… 19 findings → sandbox (tetragon eBPF · honeypot) …… credential exfil confirmed → correlate static+dynamic …………………… CRITICAL · data_exfiltration ────────────────────────────────────────────── verdict: MALICIOUS risk 92/100 · report.sarif written ✗ exit 1 — CI gate tripped, install blocked
Detection coverage

Mapped to AITech and MITRE ATT&CK.

From prompt injection to MCP tool poisoning — quarantine covers the full threat family across the agent skill supply chain, each finding carrying a rule_id, category and remediation.

AITech-1
Prompt injection
critical
AITech-4
Data exfiltration
critical
AITech-5
Credential theft
critical
AITech-6
Code execution
critical
AITech-8
Obfuscated exec
high
AITech-7
Privilege escalation
high
MCP-TP
MCP tool poisoning
critical
AITech-9
Supply-chain risk
high
AITech-11
Social engineering
high
T1547
Persistence
high
AITech-3
Tool-chaining abuse
high
AITech-10
Autonomy abuse
high
Deploy & integrate

Fits where you already work.

Skill Security is 100% self-hostable; skill content never leaves your perimeter. Pick the integration point that fits your flow.

>_

CLI & pre-commit

skillsec scan locally; a pre-commit hook blocks before code lands.

CI

SARIF → pipeline

SARIF 2.1.0 uploads to GitHub Code Scanning; exit-code gates by severity.

MCP install gate

Embed as an MCP tool; quarantine inline before a skill installs, allow or block on the verdict.

API

REST API & console

A platform registry, allowlist, alerts and audit — one verdict shared across the team.

🜛

Self-hosted sandbox

The Tetragon eBPF sandbox ships with your cluster; dynamic quarantine runs entirely inside your environment.

Mesh coordination

Verdict signals flow back to the immune mesh, sharing IOCs and threat intel with the other organs.

Start quarantining

Immunize every skill before it reaches production.

Bring your skill or MCP repo; we'll show the static + sandbox engines quarantine and block, live, on real samples.