JFrog Adds Intent Scanning for AI Agent Skills, Plugins and APM Packages
JFrog says conventional AppSec tools such as SCA and SAST can miss threats hidden in AI assets like agent skills, plugins and APM packages, because these assets carry instructions rather than only code. The company describes how JFrog AI Security scans for the intent behind them and enforces policy when an agent uses them.
- JFrog says SCA and SAST can miss threats in agent skills, plugins and APM packages because they carry instructions, not only code.
- A July 2026 study cited by JFrog tested 1,613 malicious skills against eight scanners; the strongest evasion technique beat each scanner more than 90% of the time.
- JFrog AI Security combines Xray dependency scanning with an AI-powered scanner that reads instructions and classifies assets as Not Malicious, Suspicious or Malicious.
- Policy covers per-version allow-lists, severity-based blocking and time-bound waivers, enforced by JFrog Agent Guard when the agent uses the asset.
Why SCA and SAST can miss AI assets
According to JFrog, standard application security tooling checks third-party components for known vulnerabilities (SCA), analyzes source code for flaws (SAST) and looks for exposed credentials (secret scanners). Those tools may not catch a SKILL.md file dropped into a coding agent, a plugin installed from a marketplace or an APM manifest.
The company explains the three asset types as follows:
- Agent skill: a packaged set of instructions, usually a SKILL.md file with a few scripts, that a coding agent loads into its context. It shapes how the agent handles tasks such as triaging an incident or reviewing a pull request.
- Agent plugin: a bundle of skills, MCP servers and other components, distributed through a coding agent's own marketplace.
- APM package: an Agent Package Manager is an emerging open standard that packages skills, prompts and MCP servers as versioned dependencies in a single manifest file.
JFrog's argument is that SCA has no dependency tree to resolve and SAST has no code path to trace for such assets, so the instructions themselves become a blind spot.
What the research and the threat classes show
JFrog cites a July 2026 research effort in which a team built an evasion framework that rewrote a malicious skill's suspicious tokens, commands and credential paths and hid the real payload until the agent ran it. It was tested against 1,613 real malicious skills found in the wild across eight scanners. According to the post, the strongest technique evaded each scanner tested more than 90% of the time.
The cloaked skills reportedly still worked inside production agents, including Claude Code and Codex, with no measurable drop in task success. JFrog says that even when static scanners cleared them, such skills could enable credential theft, source code exfiltration and backdoor installation.
The post lists four intent-based threat classes: prompt injection, hidden instructions, obfuscated payloads and credential exfiltration. As an illustration, JFrog gives a single line telling an agent to read ~/.aws/credentials and include the contents in its summary. There is no CVE for this, JFrog notes, because the text is valid Markdown. The agent already holds the developer's credentials, and the behavior can repeat on each teammate's machine that cloned the file.
How JFrog AI Security scans and enforces
JFrog lays out three steps from detection to prevention: scan for both code problems and intent, translate the verdict into policy, and enforce at the agent level each time the asset is invoked, not only at download. The company points out that a skill approved in March could pick up a new finding in April, and that gate-only enforcement would let it keep working on machines that already have it.
In JFrog's workflow, a developer publishes a skill to a project's skills repository in JFrog Artifactory, which triggers two scans. JFrog Xray covers what the bundle ships, such as dependencies and known CVEs. JFrog AI Security's AI-powered scanner reads the instructions themselves. Results come back as "Not Malicious," "Suspicious," or "Malicious."
Project policy then governs the skill:
- Allow-lists apply per version, so approving one version does not approve the next.
- Enforcement can be set by severity, for example blocking any skill with a Critical-severity finding.
- Legitimate exceptions can be handled with time-bound waivers that have fixed expiration dates.
JFrog Agent Guard enforces the policy at the harness, the point where an agent reaches for the asset. The same deterministic-plus-semantic approach extends to plugins and APM packages in the JFrog Platform.
What it means for teams
JFrog says skills, plugins and APM packages are stored in the JFrog Platform next to Docker images and npm packages, under the same permissions model and audit trail that security teams already use. For organizations whose developers share agent skills informally, for instance through Slack, the pitch is that AI assets can be governed within the existing software supply chain rather than in a separate console.
The company points readers to its AI assets scanning documentation to activate scanning on an existing JFrog installation, and offers a demo of JFrog AI Security. It also notes that product capabilities vary by edition and deployment model, and that the post does not guarantee any security outcome.
