Behavioral detonation · AI-agent skills
Static scanners read a skill. Skillcatraz detonates it — an unmodified capable agent drives the skill inside a locked gVisor sandbox while we record every syscall, file touch and outbound packet, then adjudicate malicious or benign. The behavioral layer the scanners structurally can't reach.
Private beta. Corroborated, responsibly-disclosed findings only.
Method
Triage keeps the cost sane; detonation does the work the scanners can't; corroboration keeps the wall honest.
Every new skill in the registry is scored on publisher, metadata and static signals. ~99% never need to detonate.
The survivors run in an ephemeral, single-use gVisor cell with decoy credentials and an internal-only network sink.
Syscalls, filesystem, and every outbound connection are captured — skill-driven behavior separated from agent-driven.
Behavior plus third-party corroboration decides it. Only confirmed true positives reach the wall, under responsible disclosure.
The yard
Live pipeline state. Confirmed-malicious stays at zero until a detection is third-party corroborated — by design.
The wall
The running record of confirmed-malicious skills — each one detonated, corroborated, and disclosed. This is the moat.
| Date | Skill | Family | Corroboration | Status |
|---|
Reports Sample
Deeper write-ups on individual detonations and the skill families behind them. Begins after the first disclosures.
Access
Private beta for teams shipping or vetting agent skills. We disclose responsibly and corroborate before we publish.
Or reach us at skillcatraz@pm.me