Listen to this Post
Introduction:
The rise of LLM agents has introduced a new, often overlooked attack surface: the agent extension supply chain. Attackers can weaponize harmless-looking Markdown skill files (like SKILL.md) to include hidden instructions for remote execution, credential theft, or persistent compromise. skill-veil v0.2.0 is a major upgrade to the open-source static and behavioral analysis tool for the agent supply chain, built in Rust and now featuring a new semantic analysis engine, LLM-adjudicated verdicts, and powerful composite detectors to catch complex threats.
Learning Objectives:
- Understand the emerging security risks in the AI agent supply chain, including malicious SKILL.md files and prompt injections.
- Learn to install and configure skill-veil for static and behavioral analysis of agent extensions.
- Master key v0.2.0 features: the NOVA semantic engine, PromptIntel integration, composite detectors, and LLM-adjudicated verdicts.
1. Installation & Initial Configuration: The 60-Second Setup
The project provides a Rust-based scanner with multiple installation paths. The easiest method for security teams is downloading a pre-built binary from the releases page.
Step‑by‑Step Setup Guide:
- Download the binary from the official GitHub releases (
skill-veilfor Linux/macOS). - Add to PATH for system-wide access, or use `cargo install skill-veil-core` if you have Rust installed.
- Verify the installation: Run `skill-veil –version` to confirm the v0.2.0 build.
- Initialize your configuration: Create a `~/.skill-veil.toml` file. This unified config manages API keys for optional integrations like VirusTotal or OpenAI for LLM enrichment.
- Test the scanner on a sample skill directory: `skill-veil scan ./my-agent-skills/`
6. Understanding exit codes: For CI/CD pipelines, a `0` exit code indicates a clean scan (or only findings allowed by policy), while a non-zero code signals `block` policy triggers, requiring human review. -
The NOVA Engine: Local Semantic Matching Without API Calls
The headline feature of v0.2.0 is the NOVA engine, which wires the community rule channel from NOVA-Hunting/nova-rules natively into the scanner. Using `fastembed` (the `all-MiniLM-L6-v2` ONNX model), it performs semantic matching on-device by default, analyzing code blocks and natural language within skills without sending data to any external API.
How to Use It:
- The `semantics:` pattern in custom rules is evaluated locally via the embedded sentence-transformer model.
- To disable the semantics engine (falling back to pure pattern matching), use the `–no-nova-semantics` flag.
- For custom rule creation, define a `semantics:` key with a target text; NOVA will compute the embedding and compare it to known benign or malicious patterns.
What This Does:
The engine parses a skill’s YAML frontmatter and markdown content, extracts code blocks, and builds an AST. This allows NOVA to understand intent, not just raw text. A request like “read the user’s SSH key and base64 encode it before sending” will trigger a semantic match, even if it uses novel phrasing that would bypass regex-based checks.
- PromptIntel & LLM-Adjudicated Verdicts: The 100% Detection Rate
PromptIntel integration brings a curated 50-prompt jailbreak corpus into the scanner. During v0.2.0’s development, a 4-LLM cohort (GPT-4o-mini, Grok‑4‑fast, DeepSeek‑v4‑pro, Qwen3.5) co-authored seven iterative rule rounds, driving detection from a baseline of 10 rules to a perfect 50/50 (100%) detection on the corpus. This closed feedback loop between LLMs and static rules enables the tool to evolve as fast as jailbreak techniques.
LLM‑Adjudicated Verdicts (ADR‑0029)
This is the game‑changer for reducing false positives. Two opt‑in flags introduce a consensus mechanism:
– --llm-adjudicate-taint: When the static engine flags an artifact as Malicious, but ≥2‑of‑3 configured LLMs disagree, the verdict is downgraded to Suspicious. This dramatically cuts analyst noise.
– --llm-adjudicate-upgrade: When the static engine marks an artifact `Suspicious` but a strong consensus of LLMs flags it as Malicious, it upgrades the verdict. Both flags are off by default in CI presets to ensure reproducibility.
Offline Tooling: The `adjudication-eval` replay tool lets you test the adjudication path on historical data, ensuring your pipeline behaves consistently.
4. Composite Detectors: Catching the k‑of‑n Threat
A single suspicious line in a skill might be a false positive. But when several benign‑alone indicators co‑occur, they can form a complete attack chain. v0.2.0 introduces a k‑of‑n composite detector framework with three built‑in, zero‑false‑positive families:
- Fake‑Dependency Dropper: Looks for a fake `package.json` or `requirements.txt` that, when combined with an install hook and a fetch from a paste‑site URL, triggers a high‑confidence flag.
- Crypto Drainer Staging: Flags sequences that check for a web3 provider, then request a “wallet connection,” followed by a “sendTransaction” call to an external address.
- C2 Beacon Staging: Detects a loop that fetches a remote “config,” then executes a shell command, and finally exfiltrates the result to a command‑and‑control server.
How to Use Composite Detectors:
- The framework is built into the default rule set. No extra configuration is needed.
- To write custom composite rules, define a list of “signals” in a rule pack, then specify `k` and
n. The detector triggers only when at least `k` of the `n` signals are present in the analyzed artifact.
5. CI/CD Reinforcement & Signed Rule Packs
skill‑veil is designed to slot directly into your DevSecOps pipeline. v0.2.0 adds a `ci-local/` Docker harness that verifies deployment and detection paths before you wire skill‑veil into your pipeline. New Bitbucket Pipelines templates are provided, and the CI guide now covers exit codes, SARIF output, the output‑capture gotcha, and air‑gapped operation.
Signed Rule Packs for Integrity
Rule packs now ship from a separate `skill-veil-rules` repository. Each pack is signed with Ed25519 signatures, and the signatures are verified against public keys embedded directly in the skill‑veil binary. This prevents a compromised rule pack from introducing malicious detection logic.
GitLab CI Example:
skill-veil-scan: stage: security image: seifreed/skill-veil:latest script: - skill-veil scan --ci-format compact --sarif reports/skill-veil.sarif ./ artifacts: reports: sarif: reports/skill-veil.sarif allow_failure: false
6. Policy Engine & Inline Suppressions
The flexible policy engine lets you define rules at the organization level. Use log, require_approval, or `block` actions, with support for profiles, waivers, and baselines. For power users, inline suppressions allow granular control without modifying global policy:
– ` skill-veil:ignore` – skips a specific finding
– `nosem` – standard semgrep‑style suppression
– `nosemgrep` – for compatibility with existing semgrep workflows
Example SKILL.md snippet with suppression:
name: "Data Processor" description: "Processes CSV files" <!-- nosem rule-id: remote-execution --> Run `python process.py --safe-mode` to parse the data.
7. Windows & Linux Commands for Skill Auditing
Linux/macOS (Bash):
Recursively scan all skills in a directory skill-veil scan ./agent-skills/ --policy strict Export findings to SARIF for CodeQL or GitHub Advanced Security skill-veil scan ./ --sarif results.sarif Use only the NOVA semantic engine, skip pattern‑based rules skill-veil scan ./ --no-patterns --nova-strength high Test a single rule pack offline skill-veil test-rules ./custom-rules/ --corpus labeled-samples/
Windows (PowerShell):
Scan a single SKILL.md file ./skill-veil.exe scan .\SKILL.md --json Enable LLM adjudication using a local Ollama instance ./skill-veil.exe scan .\ --llm-adjudicate-taint --llm-provider ollama --model llama3.2
What Undercode Say:
- Key Takeaway 1: The agent supply chain is the new software supply chain. skill‑veil v0.2.0 brings the maturity of SAST and supply chain security to the AI agent ecosystem, but most organizations have zero visibility here today.
- Key Takeaway 2: LLM‑adjudicated verdicts and composite detectors are a major leap forward. By reducing false positives and detecting multi‑stage attacks, skill‑veil makes it operationally feasible to scan thousands of skills without drowning analysts in alerts.
Analysis: The release addresses a critical blind spot. As LLM agents gain the ability to read files, run shell commands, and call APIs, attackers are shifting left—embedding malicious intent in skills and prompts. Traditional malware scanners miss this because the payload is natural language, not a binary. skill‑veil treats the skill as code, and its v0.2.0 improvements (semantic matching, composite detection, LLM consensus) raise the bar. However, the “off by default” nature of the LLM adjudicators suggests the maintainers are cautious about reproducibility—a wise stance given that LLMs are non‑deterministic. The signed rule packs and the ground‑truth corpus (curated gold corpus with 3‑LLM consensus plus human review of disputes) are best‑in‑class for open source security tools.
Prediction:
Within the next 12–18 months, “agent supply chain security” will be a recognized category in Gartner’s Hype Cycle, and tools like skill‑veil will be integrated into major CI/CD platforms (GitHub Actions, GitLab CI) by default. The next frontier will be runtime behavioral analysis—monitoring what a skill actually does when invoked, not just what it says. We will see a split: open‑source scanners like skill‑veil for pre‑commit and build‑time checks, and commercial products for runtime sandboxing and anomaly detection. The winners will be organizations that treat agent skills with the same rigor as third‑party libraries today.
▶️ Related Video (78% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Seifreed Release – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
