skillguard

To scan AI skills for prompt injection and data exfiltration, you analyze the SKILL.md file and bundled scripts using static analysis and pattern matching to detect known security vulnerabilities and unsafe automation patterns.

Agentic tool injection is a security threat where malicious instructions are hidden within AI skills to manipulate automated agents. Security scanning detects these unsafe automation patterns by analyzing SKILL.md files and associated scripts.

Yes, you can use static analysis to detect unsafe automation patterns in SKILL.md files. It analyzes the markdown content and bundled scripts using pattern matching to identify prompt injection and data exfiltration threats.

When reporting security vulnerabilities in AI skills, supported output formats include markdown, JSON, and table formats. These formats present detected threats like prompt injection and data exfiltration from the static analysis.

You should run a security scanner on AI skills before integrating them into your workflow. This ensures the SKILL.md and scripts do not contain hidden malicious instructions, prompt injection, or data exfiltration attempts.