Formal verification for AI agent skills. One command auto-discovers and verifies every agent tool on your system across 22 frameworks. Five mathematical soundness theorems. 1,818 tests. F1 96.95% on the 540-skill evaluation dataset (arXiv:2603.00195).
All metrics measured on the 540-skill evaluation dataset from arXiv:2603.00195. Benchmark precision was measured at 1.0 on this dataset; results on other datasets may differ.
Pattern-matching scanners only catch known attack signatures. ClawHavoc-class supply chain attacks embed capability escalation in legitimate-looking skill manifests, bypassing heuristic detection entirely. Heuristics cannot prove safety — formal verification can.
SkillFortify's discovery engine checks 23+ IDE profiles and configuration paths automatically.
Every framework listed ships a first-class adapter with tested schema parsing. Unknown tools are handled by the auto-discovery engine across 23+ IDE profiles.
| Capability | SkillFortify | Heuristic scanners |
|---|---|---|
| Verification method | Formal (5 theorems) | Pattern matching |
| Novel attack detection | Yes — proof-based | No — signature-only |
| False positive rate (benchmark) | 0 / 540 on 540-skill eval dataset † | Framework-dependent |
| Multi-framework support | 22 frameworks | Typically 1–3 |
| SBOM generation | CycloneDX / SPDX | Rarely |
| CI/CD integration | SARIF output, exit codes | Varies |
| Lockfile support | Cryptographic commitment | Not standard |
| License | Elastic License 2.0 (ELv2) | Varies |
† False positive rate measured on the 540-skill evaluation dataset (arXiv:2603.00195). This is a benchmark result on a specific dataset; rates on other datasets may differ.
SkillFortify's verification engine is built on five formally stated and proved theorems. See arXiv:2603.00195 for full proofs.
If SkillFortify certifies skill S at trust level L, then S cannot invoke capabilities beyond those declared in its manifest at level L. Proved by induction on the capability lattice.
No sequence of well-formed tool calls can escalate a verified skill's trust level at runtime. The trust assignment is immutable post-verification.
If skills S1 and S2 are individually verified, their composition S1∘S2 cannot produce capability violations not present in either. Verification is composable.
For any agent framework F in the supported set, if an installed tool T implements F's schema, SkillFortify's discovery phase will enumerate T with probability 1 (given read access).
A lockfile generated by skillfortify lock is a cryptographic commitment to the skill set. Any mutation to the skill set produces a verifiable lockfile mismatch.
Every verified skill is assigned one of four trust levels. Each level restricts the capability set the skill can access at runtime.
SkillFortify's verification artifacts map to three major frameworks. Compliance is a by-product of correct verification, not a separate workflow.
Formal verification of skill capability bounds provides documented evidence for EU AI Act Article 15 robustness requirements under the high-risk category.
SBOM output (CycloneDX/SPDX) and lockfile artifacts integrate directly with NIST AI Risk Management Framework inventory and traceability requirements.
Cryptographic lockfiles and SBOM generation address Executive Order 14028 software supply chain security requirements for AI-adjacent tooling.
Part of Qualixar · Elastic License 2.0 (ELv2) · Built by Varun Pratap Bhardwaj