provider-screener

Static analysis for AI skill code detects security vulnerabilities through a 5-layer process checking hard-rejects, exfiltration, injection, external dependencies, and undeclared permissions. It returns a scored verdict of APPROVE, REVIEW, or REJECT with detailed reasons.

Automated code review for AI safety validates permissions by flagging undeclared capabilities during static analysis. It scans skill content to ensure declared permissions match actual code behavior, returning a scored verdict with detected capabilities and detailed security reasons.

Yes, you can use static analysis to prevent data exfiltration before deploying a new AI skill. The screening process detects exfiltration attempts alongside injection vulnerabilities and external dependencies, ensuring the skill adheres to safety policies when interacting with user data.

Security validation does check external dependencies in AI skill code. The static analysis process includes a dedicated external dependency check layer to identify and evaluate undeclared or unsafe dependencies before returning a final APPROVE, REVIEW, or REJECT verdict.

Static analysis for validating AI skill security is limited to detecting hardcoded flaws, exfiltration, injection, and undeclared permissions. As a static validation method, it may not catch dynamic runtime behaviors or complex logic flaws that only emerge during active execution.

The best way to secure AI skills against injection vulnerabilities is using a multi-layered static analysis process. It specifically detects injection attempts alongside exfiltration and undeclared permissions, providing a clear APPROVE, REVIEW, or REJECT verdict with detailed security reasons.