SkillFortify: First Formal Security Scanner for AI Agent Skills with SBOM Generation Across 22 Frameworks

GitHub / Qualixar·low signal

SkillFortify launched as the first formal security scanner for AI agent skills and plugins, supporting 22 frameworks including MCP, LangChain, and CrewAI. It provides capability-based access control with POLA compliance checks, agent dependency graph conflict detection, trust score algebra with propagation through dependency chains, ASBOM generation in CycloneDX 1.6 format, and registry scanning. Each skill entry includes SHA-256 integrity hashes for tamper detection. Open source under MIT license with no cloud dependencies — pip installable.