PaperlayerView exact revision on arXiv

Source-linked AI summary

Formal Analysis and Supply Chain Security for Agentic AI Skills

Varun Pratap Bhardwaj

arXiv:2603.00195v2cs.CRcs.AIcs.SE

TL;DR

Agent skill ecosystems lack formal guarantees despite broad privileges, recurring supply-chain attacks, and heuristic defenses. The paper develops a formal threat model, sound capability-based analysis, sandboxing, dependency resolution, trust algebra, and a benchmark. On its benchmark, SkillFortify reports 96.15% F1 and 0.00% false positives, while information-flow analysis adds no detections over pattern matching on this corpus.

  • Problem

    Agent skill ecosystems face supply-chain vulnerabilities and heuristic defenses without formal guarantees that skills stay within declared capabilities.

  • Method

    The paper combines formal threat modeling, abstract-interpretation analysis, capability confinement, SAT-based dependency resolution, trust scoring, and a 540-skill benchmark.

  • Results

    96.15% F1 and 0.00% false positive rate were measured on the benchmark, while information-flow analysis added no detections over pattern matching on this corpus.

  • Takeaways & Limitations

    The results support formal analysis with explicit guarantees while reporting that information-flow analysis provided no added coverage on this corpus.

  • Takeaways & Limitations

    The soundness guarantee is relative to the modeled abstract domain, while relational attacks such as typosquatting and dependency confusion remain outside individual-skill content analysis.

Abstract

from arXiv · show

32 pages, 5 theorems with full proofs, 68 references, open-source tool: https://github.com/qualixar/skillfortify. v2: corrects the bibliography (22 entries had author lists that did not match the papers at the cited arXiv identifiers; all verified against the arXiv API and corrected, and affected authors notified) and three external claims against primary sources: MalTool reports 1,300 standalone and 5,727 embedded malicious tools, not 6,487; CVE-2026-25253 is authentication-token exfiltration via an unvalidated gatewayUrl, credited to depthfirst and fixed in 2026.1.29, not remote code execution through a crafted skill package; ClawHavoc counts are 341, later 824, and 1,184 by source and date, not "over 1,200". All experiments re-measured against the released v0.6.0 implementation using harnesses now committed to the repository. E1/E2 unchanged (F1 96.15%). E3 reverses to a negative result: information flow analysis adds no detections over pattern matching on this corpus. The soundness theorem's scope is stated explicitly and no longer conflated with the zero false-positive rate.

1 Introduction

The paper addresses a security gap in agent skill ecosystems, where broad privileges and heuristic defenses leave no formal guarantee against capability violations. SkillFortify combines formal modeling, static analysis, sandboxing, dependency resolution, trust scoring, and empirical evaluation.

  • 26.1% of 42,447 agent skills exhibit at least one security vulnerability.
  • Agent skills reproduce software-supply-chain trust problems while executing with broad privileges in language-model contexts.
  • SkillFortify provides a formal, capability-oriented alternative to heuristic scanning, with machine-checkable safety certificates.
  • The framework introduces DY-Skill, a Dolev–Yao adaptation for the five-phase agent skill supply chain.
  • The system combines sound static analysis, capability confinement, SAT-based dependency resolution, trust propagation, and SkillFortifyBench.
  • 96.15% F1 with 100% precision and 0% false positive rate was reported on the 540-skill benchmark, while combined analysis was evaluated against pattern matching.

2 Background

The background situates agent skills within rapidly expanding ecosystems and documents vulnerabilities, malicious campaigns, and the limits of heuristic defenses. It motivates formal capability controls and integrates software-supply-chain foundations with AI-specific security concerns.

  • Agent skills augment LLM agents with capabilities such as web search, file manipulation, database querying, and external-service interaction.
  • OpenClaw uses an install-and-run model in which skills execute with full system privileges without required formal review, signing, or capability declarations.
  • The major ecosystems share the absence of a formal capability model constraining behavior to declared capabilities.
  • CVE-2026-25253 involved authentication-token transmission through an unvalidated gatewayUrl, enabling remote code execution through the victim’s gateway after a click.
  • MalTool synthesized 1,300 standalone malicious tools and 5,727 embedded malicious tools, while large-scale scans found widespread vulnerabilities and malicious entries.
  • Existing defenses rely on heuristic or signature-based detection, whereas SkillFortify adds formal guarantees and an Agent Skill Bill of Materials compatible with CycloneDX.
  • Capability security and object-capability foundations provide the basis for least-authority sandboxing in the proposed framework.

3 Formal Threat Model

The formal threat model represents the agent skill supply chain as a phased system with mapped attack classes, adversary categories, and a DY-Skill attacker. A maximality theorem justifies using this attacker for the paper’s security analyses.

  • 3.1 Agent Skill Supply Chain: The supply chain is modeled as SC = (A, R, D, E), traversed through five ordered lifecycle phases.
  • 3.1 Agent Skill Supply Chain: Install, Load, and Configure expose name confusion, dependency confusion, prompt injection, over-permissioning, and capability-escalation surfaces.
  • 3.1 Agent Skill Supply Chain: Execute and Persist expose broad-authority risks including data exfiltration, privilege escalation, prompt injection, state poisoning, and leakage through durable storage.
  • 3.1 Agent Skill Supply Chain: Attacks can propagate forward across later lifecycle phases, so an Install compromise can enable arbitrary code execution at Execute.
  • 3.2 Attack Taxonomy: The taxonomy defines six attack classes mapped to applicable phases, including data exfiltration, privilege escalation, prompt injection, dependency confusion, typosquatting, and namespace squatting.
  • 3.2 Attack Taxonomy: The attack surface contains 10 distinct phase–class pairs, and adversary capabilities vary by access vector from malicious authors to insiders.
  • 3.3 The DY-Skill Attacker Model: DY-Skill adapts Dolev–Yao network control to skill packages and extends it with authoring and registry operations specific to this supply chain.
  • 3.4 Theorem 1: DY-Skill Maximality: Theorem 3.6 states that every symbolic attacker trace can be simulated by a DY-Skill attacker with equivalent observable effects, making DY-Skill maximal under perfect sandboxing.

4 Static Analysis Framework

SkillFortify combines capability inference, dangerous-pattern detection, and declaration checking in a static analyzer grounded in abstract interpretation. Its soundness guarantee is limited to modeled capability behavior and permits false positives while excluding missed accesses within that scope.

  • Three-Phase Analysis: The analyzer has three phases: capability inference, dangerous-pattern detection, and capability violation checking against declarations.Inference uses abstract interpretation; pattern detection draws on incident-derived threat patterns.
  • Capability Lattice: The capability model uses four ordered access levels: NONE, READ, WRITE, and ADMIN.READ permits observation, WRITE permits observation and mutation, and ADMIN additionally permits granting or revoking access.
  • Capability Lattice: A capability set maps each resource to an access level in a complete product lattice ordered pointwise.The resource universe includes filesystem, network, environment, shell, skill invocation, clipboard, browser, and database.
  • Abstract Skill Semantics: The abstract semantics over-approximate concrete skill behavior through a Galois connection.The abstraction extracts a capability footprint, while concretization returns states bounded by that abstract capability set.
  • Capability Inference: Each transfer function is sound because its abstract result contains the concrete states matching the detected pattern.Table 2 verifies α(concrete) ⊑ abstract for every resource-pattern row.
  • Analysis Soundness: If no violations are reported, every concrete execution stays within declared capabilities for the modeled properties.The guarantee is relative to the abstract domain and does not claim that no malicious behavior exists; dynamically constructed commands or URLs may require dynamic analysis.

5 Capability-Based Sandboxing

The capability-based sandbox treats unforgeable capabilities as the sole source of authority and checks every action against declared permissions. Delegation attenuates authority, while the runtime confinement theorem remains a design guarantee for a future implementation rather than a feature of SkillFortify v1.

  • Capability Model: Capabilities are unforgeable and eliminate ambient authority: skills cannot access resources merely because those resources exist.Authority can arise only through initial conditions, parenthood, endowment, or introduction.
  • Capability Enforcement: The sandbox mediates every action by checking its required capability against the skill’s declared capability set.An empty violation set establishes CapI ⊑ CapD for the analyzed skill.
  • Capability Attenuation: Delegation cannot amplify authority because a child receives at most the capabilities already held by its parent.This implements least authority and bounds transitive authority across delegation chains.
  • Static Confinement: The static confinement theorem states that a skill with no violations performs no operation exceeding its declared capability levels.The proof proceeds by structural induction over assignments, conditionals, loops, and function calls.
  • Runtime Confinement: Runtime confinement is specified as a design theorem requiring a correctly implemented capability-safe sandbox.SkillFortify v1 provides static guarantees; runtime enforcement is reserved for future work.

6 Agent Dependency Graph and Lockfile Semantics

The Agent Dependency Graph extends package dependency resolution with capability constraints, enabling SAT-based secure installation decisions. Lockfiles and ASBOMs provide reproducibility, integrity, auditability, and compliance-oriented inventories.

  • Agent Dependency Graph: The ADG captures skill versions, dependencies, conflicts, and per-version capability requirements.
  • Agent Dependency Graph: Capability map Cap lets the resolver reject skill-versions exceeding the security policy before installation.
  • SAT-Based Resolution: SAT clauses encode version uniqueness, root requirements, dependencies, conflicts, and capability bounds.
  • SAT-Based Resolution: Clause family C5 ensures no installation plan includes a skill-version whose runtime requirements exceed the declared security policy.
  • Lockfiles and ASBOM: Lockfiles serialize secure installations with hashes and metadata, while ASBOMs inventory dependency closures in CycloneDX format.
  • Resolution Soundness: Theorem 6.10 states that satisfiability is equivalent to secure installability, and satisfying assignments induce secure installations and lockfiles.
  • Complexity and Outputs: Resolution remains NP-complete in general, while experiments report times under 0.5 seconds for 500 skills.

7 Trust Score Algebra

The trust score algebra combines four orthogonal signals into a bounded score, propagates trust conservatively through dependency graphs, models decay during inactivity, and maps scores to assurance levels. Its design also guarantees order-independent dependency evaluation and non-decreasing scores when authors improve supported trust signals.

  • Trust signals: Four orthogonal signals measure provenance, behavior, community adoption, and historical reliability for each skill version.The signals are individually bounded in [0, 1] and distinguish who published a skill, what it does, how widely it is adopted, and its past reliability.
  • Intrinsic trust: The intrinsic score is a weighted linear combination of the four signals and remains in [0, 1] when weights are non-negative and sum to 1.The default weights prioritize provenance and behavioral analysis at 0.3 each, with community and historical signals weighted at 0.2 each.
  • Dependency propagation: Effective trust uses deduplicated transitive dependencies and multiplicative composition, so a skill inherits risk from its least-trusted dependency.Deduplication resolves diamond-shaped dependency ambiguity and makes the result independent of traversal order.
  • Dependency propagation: The effective-trust definition is uniquely determined by the dependency DAG and is bounded by the skill’s intrinsic trust and the minimum intrinsic trust in its closure.The min operator is order-independent, while multiplicative composition conservatively attenuates trust across dependency chains.
  • Temporal decay: Exponential decay reduces trust during inactivity; at λ = 0.01 day^-1, trust halves approximately every 69 days.The decay function is bounded by the initial effective score, approaches zero asymptotically, and resets when the skill is updated.
  • Assurance levels: The trust system maps continuous scores to graduated assurance levels and guarantees that improvements in provenance, vulnerability history, or behavioral verification never decrease a skill’s score.The mapping is inspired by SLSA, while the incentive-compatibility property supports investment in skill quality.

8 Implementation

SkillFortify implements the paper’s formal security framework as an open-source Python tool with static analysis, dependency resolution, and trust computation engines. It supports major skill formats, exposes commands for scanning and verification, and states a clear boundary: guarantees cover deterministic structural artifacts, not purely stochastic runtime behavior.

  • Architecture: SkillFortify connects static analysis, dependency resolution, and trust computation through a shared Threat Knowledge Base.The architecture combines attack-taxonomy patterns, capability modeling, dependency constraints, and trust-signal configurations.
  • Static analysis: The static analyzer uses 13 attack-type patterns plus information-flow tracking from sensitive sources to untrusted sinks.The implementation targets structural behaviors such as environment exposure, filesystem access, network endpoints, and external processes.
  • Dependency resolution: SkillFortify resolves dependency graphs with semantic-version constraints, SAT-based conflict detection, deterministic lockfiles, and O(|V| + |E|) cycle detection.The resolver implements the Agent Dependency Graph model and uses Kahn’s algorithm for cycle detection.
  • Trust engine: The tool’s formal trust algebra satisfies commutativity, associativity, identity, annihilation, idempotence of min, and monotonicity.These properties follow from multiplication and minimum over the bounded interval [0, 1].
  • Scope and limitations: The formal guarantees apply to deterministic code, configuration, metadata, and extracted operations, but not to runtime behavior arising purely from stochastic LLM reasoning.Dynamic attacks driven by model interpretation require complementary runtime or dynamic analysis techniques.
  • Supported formats: Automatic format detection normalizes Claude Code Skills, MCP Server manifests, and OpenClaw Skills into a unified representation for analysis.Parser dispatch uses file extensions and content heuristics, after which all three engines consume normalized metadata.
  • CLI and engineering: The CLI provides scan, verify, lock, trust, and sbom commands, with scan producing terminal, JSON, and SARIF security reports.The implementation contains 2,567 lines of Python across 44 source files and 473 automated tests.

9 Evaluation

Across seven experiments, SkillFortify met six targets: it achieved strong detection and operational properties, while information-flow analysis added no detections over pattern matching on this corpus.

  • Per-format detection accuracy: Claude Code and OpenClaw each achieved F1 = 98.31%, while MCP server configurations reached 84.44% recall.MCP configurations expose less analysable surface than instruction documents.
  • Per-attack-type detection accuracy: Six of 13 attack types reached 100% detection; DNS-based exfiltration reached 94.4%, prompt injection 87.5%, and typosquatting 50%.Dependency confusion reached 0% detection, while some compact MCP structures resisted pattern extraction.
  • False positive rate: Zero false positives were measured across all 270 benign skills, with a 95% Wilson CI of [0.0%, 1.4%].This empirical rate is not implied by the soundness theorem and depends partly on the constructed benign corpus.
  • Combined analysis coverage: Information-flow analysis added no detections: its 44 firings all overlapped pattern matches, leaving the detected set unchanged at 250 skills.The result does not settle whether the outcome reflects the technique or this corpus.
  • Formal guarantee: The formal layer guarantees capability confinement within its modelled domain, rather than providing incremental detection or proving that no risk is present.This soundness guarantee is narrower than a claim that no findings means no risk.
  • Scalability and reproducibility: Dependency resolution took 26.7 ms at 1,000 skills, while repeated lockfile outputs were byte-identical across all 10 configurations.Determinism uses canonical serialization, fixed SAT variable ordering, and SHA-256 artifact hashing.
  • End-to-end performance: A complete scan of 540 specimens took a median 0.293 seconds, and six of seven experiments met their target thresholds.The reported scan time is machine-specific and should be treated as an order-of-magnitude characterization.

10 Related Work

SkillFortify is positioned against heuristic agent-skill scanners, formal security analyses, and software supply-chain frameworks. Its distinction is combining established formal foundations with capability, dependency, and trust analyses for agent skills.

  • Agent Skill Security: Existing agent-skill tools use heuristic detection, while SkillFortify provides formal guarantees about analyzed capabilities and dependencies.Prior tools include LLM-as-judge, YARA, regex, and behavioral heuristics; SkillFortify proves sound analysis, capability confinement, and resolution correctness.
  • Formal Analysis: SkillFortify extends abstract interpretation to agent-skill capabilities using a four-element lattice rather than numerical intervals.The capability lattice models NONE, READ, WRITE, and ADMIN permissions.
  • Formal Analysis: SkillFortify complements transactional tool semantics by verifying that tools are safe to invoke, whereas transactional systems ensure multi-step calls execute atomically.The comparison separates supply-chain verification from execution atomicity.
  • Software Supply Chain Security: Its sandboxing model instantiates object-capability results for agent skills, while its dependency resolver extends SAT-based resolution with per-skill capability constraints.The framework also adapts trust frameworks such as SLSA, Sigstore, and PolicyMaker to multi-signal skill scoring with exponential decay.
  • Standards: The framework generates CycloneDX-format ASBoMs and provides mechanisms aligned with NIST AI RMF and EU AI Act concerns about third-party AI components.This connects supply-chain analysis with existing software and AI-component standards.

11 Discussion

The discussion narrows SkillFortify’s guarantees to capability confinement and identifies important blind spots, especially relational attacks, dynamic behavior, unavailable trust signals, and non-comparable external baselines. It also frames the tool as one layer in a broader defense-in-depth architecture.

  • Limitations: Typosquatting and dependency confusion achieve 50% and 0% detection rates because they require external registry or namespace comparisons beyond individual skill content.Addressing these attacks requires registry or organizational namespace integration.
  • Soundness and Its Scope: Theorem 4.9 guarantees confinement only for behaviors modeled by the abstract domain, not detection of every malicious skill.Unmodeled deceptive names, namespace collisions, and registry-dependent effects remain outside the theorem’s reach.
  • Empirical Boundaries: 20 false negatives (7.4%) occur across the whole corpus, concentrated in relational attacks and compact MCP configurations with little analyzable surface.Six of the 13 attack types are detected without exception.
  • Soundness and Its Scope: Zero false positives is an empirical completeness result on this benchmark, not a consequence of Theorem 4.9’s soundness guarantee.A sound over-approximation can produce false positives; the observed zero rate is specific to the specimens and reporting threshold.
  • Dynamic Analysis: Static analysis can miss runtime-generated malicious behavior, including payloads fetched after inspection and subtle dynamic exfiltration channels.This limitation follows from SkillFortify’s exclusively static analysis design.
  • External Baseline Comparison: SkillFortify is not directly compared with Snyk, Cisco, or ToolShield on a shared labeled dataset because reproducible benchmarks and compatible access are unavailable.The paper instead compares reported metrics and identifies controlled multi-tool evaluation as future work.
  • Complementary Systems: AgentAssert and SkillFortify compose defense in depth by pairing runtime behavioral contracts with pre-execution supply-chain and capability checks.The paper presents this layered combination as stronger assurance than either system alone.
  • Future Work: Future work targets registry provenance, multi-skill composition, typosquatting detection, and IDE or runtime integration.These directions address external trust signals, interaction effects, relational naming attacks, and dynamic enforcement.

12 Conclusion

The paper argues that agent-skill ecosystems require formal supply-chain security rather than heuristic scanning alone. SkillFortify combines formal models, proofs, dependency management, trust scoring, and a labeled benchmark, with strong measured performance but no added E3 coverage from information-flow analysis.

  • Conclusion: Agent-skill growth, malicious campaigns, vulnerabilities, and malicious-tool synthesis make the install-and-trust paradigm a supply-chain security concern.The conclusion cites ClawHavoc, CVE-2026-25253, and MalTool as motivating evidence.
  • Contributions: SkillFortify combines DY-Skill threat modeling, sound abstract interpretation, capability confinement, SAT-based dependency resolution, trust scoring, and a 540-skill benchmark.The benchmark covers three formats and 13 attack types.
  • Results: 96.15% F1 and 0.00% false positive rate were achieved on the benchmark, while 1,000-skill dependency resolution took a median 27 ms and 540-skill scanning a median 0.29 seconds.The false-positive rate has a 95% CI of [0.0%, 1.40%].
  • Results: Six of seven evaluation experiments met their target thresholds, but information flow analysis added no detections over pattern matching on this corpus.The paper reports the negative E3 result rather than claiming the intended improvement.
  • Takeaway: The paper recommends formal threat models, mathematical guarantees, and defense in depth adapted to stochastic behavior, natural-language interfaces, and multi-skill interactions.It frames this transition as relevant as deployments move toward enterprise production.
  • Reproducibility: Every reported figure is reproducible from committed repository harnesses and deterministic benchmark outputs.Detection metrics and experiments record inputs and measurements under the released implementation.

About the Author

The supplied material presents the author’s enterprise technology and legal background, prior formal-methods work, and the paper’s proof-oriented treatment of agent-skill security. The appendix restates and proves the DY-Skill maximality theorem by simulating arbitrary polynomial-time skill-channel adversaries.

  • About the Author: Varun Pratap Bhardwaj brings more than 15 years of enterprise technology experience across cloud, platform engineering, and large-scale system design.His background spans Fortune 500 clients in retail, telecommunications, and financial services.
  • About the Author: His dual technology and law qualifications inform work on regulatory compliance for autonomous AI systems.The paper names the EU AI Act, NIST AI RMF, and emerging agent governance as relevant areas.
  • Research Focus: His research focuses on formal methods for AI-agent safety, including AgentAssert and SuperLocalMemory before SkillFortify.SkillFortify is described as the third product in this suite.
  • Proof Appendix: The appendix provides complete proofs for all five theorems and restates each theorem before its proof.This establishes the appendix’s role as the paper’s self-contained proof section.
  • DY-Skill Model: The DY-Skill adversary controls communication between the agent runtime and skill environment while retaining polynomial-time execution constraints.Its model includes channel manipulation, skill forgery, and registry compromise subject to cryptographic-signature constraints.
  • DY-Skill Maximality: Theorem A.4 states that DY-Skill simulates every PPT skill adversary and subsumes the classical Dolev–Yao adversary on standard protocol channels.The proof gives exact simulation for the skill-channel claim and identity embedding for classical Dolev–Yao strategies.
  • DY-Skill Maximality: The maximality proof classifies arbitrary adversary actions into channel manipulation, skill forgery, registry manipulation, and computation on observed data.Each category is simulated by a corresponding DY-Skill capability.

A.2 Theorem 4.9: Analysis Soundness

The paper proves that its capability analysis soundly over-approximates concrete resource access for skills whose inferred capabilities satisfy their declarations. The proof establishes local transfer-function soundness and lifts it to composite skill constructs by structural induction.

  • Theorem statement: Theorem A.5 states that declared capabilities bound every concrete resource access when analysis reports no violations.The theorem is stated over the capability domain L|C| and requires Viol(s) = ∅.
  • Transfer-function soundness: The proof verifies that each resource-specific abstract transfer function over-approximates the corresponding concrete capability footprint.The abstraction assigns a capability level ℓ♯ such that α_r(S) ⊑ ℓ♯ for every matching concrete state set.
  • Transfer-function soundness: URL, HTTP-write, shell, environment, filesystem, and skill-invocation patterns map concrete accesses to READ or WRITE capability levels.The examples show that each detected operation receives an abstract level at least as high as its concrete access.
  • Structural induction: Structural induction covers sequential composition, conditionals, and loops, with joins and finite-height fixpoints preserving over-approximation.The capability lattice has finite height 48 = 65,536, so the loop fixpoint stabilizes.
  • Soundness scope: The resulting theorem bounds every reachable operation’s required capability by the skill’s declared capability set without assuming runtime sandboxing.The confinement proof relies on Cap_I and the hypothesis Cap_I(s) ⊑ Cap_D(s), not on a runtime sandbox mechanism.
  • Soundness scope: Runtime confinement additionally requires no ambient authority, unforgeable capabilities, and sandbox mediation of every action.Under these assumptions, the available capabilities are limited to the declared initial endowment.

B.2.1 Malicious Claude Code Skill (A1 — Data Exfiltration via HTTP).

The benchmark examples illustrate detection of malicious data exfiltration and code execution alongside correct benign classification. SkillFortifyBench uses deterministic, single-attack synthetic skills to support reproducible per-type evaluation, while real-world representativeness remains limited.

  • Malicious Claude Code Skill (A1 — Data Exfiltration via HTTP).: SkillFortify detects environment-variable data flowing through env_data to an external requests.post sink, alongside the corresponding A1 pattern match.The example reports both pattern matching and information-flow findings for the same malicious skill.
  • Malicious MCP Server Configuration (A4 — Arbitrary Code Execution).: SkillFortify detects subprocess.Popen with shell invocation piped through curl, matching the A4 arbitrary-code-execution pattern.The command passes inline Python via -c and resembles patterns observed in ClawHavoc payloads.
  • Benign OpenClaw skill: The benign JSON-formatting skill declares only read_local permission and is classified benign because no malicious patterns or information-flow violations are detected.Its inferred capabilities remain within the declared capability set.
  • Benchmark construction: Each malicious benchmark skill contains exactly one primary attack type, enabling precise per-type attribution but simplifying comparison with real-world malware.Real-world malicious skills may combine techniques, use obfuscation, or rely on social engineering.

C.3 Example Lockfile

The example skill-lock.json demonstrates deterministic ordering, dependency resolution, recorded trust and analysis status, and integrity protection. Its canonical serialization keeps the top-level SHA-256 hash stable across platforms and Python versions.

  • Example lockfile: The example lockfile contains a three-skill configuration with deterministic metadata and canonical hashes.The listing is presented as an example skill-lock.json for a three-skill agent configuration.
  • Deterministic ordering: Skills are sorted alphabetically, so repeated locking of the same configuration produces byte-identical output.The example order is api-client, file-manager, and json-formatter.
  • Dependency resolution: The resolver selects file-manager version 2.1.0 for json-formatter’s constraint >=2.0.0.The selected version satisfies the declared dependency constraint.
  • Trust and analysis status: Each skill records its trust score at lockfile generation, enabling later comparison for degraded confidence.The paper associates lower future trust with newly discovered vulnerabilities or absent maintenance activity.
  • Trust and analysis status: A warning status with one low-severity finding is recorded for api-client, while only critical status blocks locking by default.The warning does not prevent lockfile generation but remains available for audit.
  • Integrity protection: The top-level integrity field is a SHA-256 hash of the canonical skills JSON, so changing entries, versions, or hashes invalidates it.Sorted keys, consistent two-space formatting, no trailing commas, and UTF-8 encoding stabilize the hash.
Loading 2603.00195v2…