For Practitioner · the method
How we solve it.Piece by piece, with provenance.
How the skill scan actually works — what gets read, what gets flagged, how combinations become attack chains, and how a verdict is earned. This is the SkillGuard methodology.
The exhibits
The working surfaces behind the answer.
The chain is the threat
Individual skills can scan clean while their combination creates a critical data-exfiltration path. An attack graph catches cross-skill composition risk before admission, not after deployment.
Swipe horizontally on small screens to read the full chain.
Piece 1
Capability extraction
Inputs
- Every SKILL.md and script in a repo — read statically, never executed
Mechanism
- Each skill is parsed into a bill of materials: what it can touch (network, shell, filesystem read/write, secret access, package install, git write) and a risk score
- On the public reference repo that yields 56 skills read and 7 capability classes observed
- The rule per class is published rather than described: network → \b(requests\.|urllib|http\.client|socket\.|curl\s|httpx|aiohttp)\b · shell → \b(subprocess\.|os\.system|os\.popen|shell=True|Popen\() · filesystem-read → \bopen\([^)]*['\"]r[b]?['\"]|Path\([^)]*\)\.read_text · filesystem-write → \bopen\([^)]*['\"]w[ab]?['\"]|shutil\.(copy|move)|os\.remove|os\.rmdir · secret-access → \.env\b|\.ssh\b|credentials?\.json|api[_-]?key|private[_-]?key|\bpassword\b|\btoken\b · package-install → \bpip\s+install\b|\bnpm\s+install\b|\bapt(-get)?\s+install\b|\bbrew\s+install\b · git-write → \bgit\s+(push|commit)\b
Outputs
- A per-skill BOM — the ground truth every later judgment stands on
Provenance: tools/skill_supply_chain.py (stdlib-only) is the authority; the published patterns are reconciled against it by tools/check_skillguard_patterns.py in the prebuild chain. Reproduce the scan with python3 tools/gen_reference_skillbom.py.
The deeper layer — named here, shown in a walkthrough
- The risk-score composition and thresholds
Piece 2
Detection & triage
Inputs
- The per-skill BOM plus the raw skill text
Mechanism
- Pattern classes fire on risk shapes — instruction-override phrasing (prompt injection), download-and-execute installer chains, risky capability combinations
- Every finding requires a written human verdict before the repo is called clean: 3 findings on the reference repo, 3 triaged, 0 open
- No verdict, no pass — triage failure fails closed
Outputs
- Findings with severity, evidence line, and a written reason — the literal output you see on SkillGuard
Provenance: The same scanner output the /skillguard page renders; the prebuild chain fails if any finding is untriaged.
The deeper layer — named here, shown in a walkthrough
- The full detection-pattern set with the exact signatures each fires on
- The triage protocol: what a written verdict must establish before a finding may close
Piece 3
Chain mapping
Inputs
- The capability BOMs of every skill installed together
Mechanism
- Combinations are judged as chains, not one by one: a skill that reads secrets plus a skill that talks to the network is an exfiltration path even when each is individually clean
- The attack graph names the chain shapes so an incident traces to a link, not a shrug
Outputs
- A combination map for the running set — which pairs create paths, and which link to pull when something fires
Provenance: The attack-graph model on the practitioner page; chain categories align with the scanner’s capability taxonomy.
The deeper layer — named here, shown in a walkthrough
- The pair rules: which capability combinations constitute which chain class
- The containment order when a chain fires
Piece 4
The reskilling list
Inputs
- The Track 2 reskilling master list: 247 AICM controls, each attributed to one persona owner with a skill verb and a capability prompt
- Your saved diagnostic answers, where a run exists: the same answers Track 1 scored
Mechanism
- Controls that watch the AI, respond when it goes wrong, hunt the weaknesses, control identity and access, protect the data, hold the keys, harden the ground, and keep it running resolve to the practitioner as primary
- Track 2 is the diagnostic inverted: a control absent or breached in a function’s answers is re-read as the named skill this role acquires. No second scorer, no second instrument
Outputs
- 113 controls resolving to this role across 8 skill groups, 21 of them gating the autonomy climb — a named skill list: direction and next rung, never a complete how-to
Provenance: tools/reskill-persona-map.json → lib/reskill-master.ts (owner sample-review approved 2026-07-17); gaps join in lib/reskill-deltas.ts.
The deeper layer — named here, shown in a walkthrough
- The per-control attribution table for this role and the judgment notes on boundary controls
Piece 5
The stack & instruments
Inputs
- 16 published instruments in three lanes — 14 testers, 3 corpora, 5 controls — validated at every build
- Python 3 stdlib-only tooling — nothing to install to reproduce a claim
Mechanism
- The scanner itself is one of the instruments; tester-lane tools exercise skills against fixed attack corpora before a skill earns its place in the set
- Corpus-lane instruments hold the test sets steady so every re-run is comparable — the fit is proven against the same corpus that failed the baseline
- Lane integrity is machine-enforced: an instrument never grades its own lane, and nothing on this site says "tested" without a named instrument behind it
Outputs
- A named, reproducible instrument behind every tested claim you read here
Provenance: lib/tools-registry.ts, guarded by validate-tools in the prebuild chain; instrument detail renders in the /controls drill.
The deeper layer — named here, shown in a walkthrough
- The per-instrument wiring: which tool validates which skill, and which tool grades which instrument
- Acceptance thresholds per tester lane
- The corpus construction rules: attack classes, held-out discipline, benign sets
Canonical surfaces
The live scan (SkillGuard) →How skills are built and fitted (essay) →