AI artifact scanning should be a first-class gate in your software delivery lifecycle, the same way SAST and dependency scanning already are. The mistake most teams make isn't skipping this entirely. It's treating every layer of the pipeline as if it belonged at the same stage, when the three layers carry very different costs and latency profiles.

Static analysis: the pre-merge gate

Static analysis is lightweight and deterministic, which makes it the right fit for a pre-merge gate on pull requests, running on every commit without meaningfully slowing anyone down. A high-severity static finding, an unmistakable credential-harvesting pattern or an obfuscated execution chain, should block merge until a human reviews or explicitly waives it. This mirrors exactly how existing SAST tools already function in most SCM-integrated pipelines, and it requires minimal new infrastructure for teams already running GitHub Actions, GitLab CI, or an equivalent.

Dynamic analysis: a validation layer, not a triage layer

Sandboxed execution requires spinning up an isolated environment per skill, which is meaningfully more expensive than a static scan at repository scale. That cost is exactly why it belongs at a later stage: pre-deployment, or as part of a periodic re-scan schedule, rather than running on every single commit. Dynamic analysis adds the most value on artifacts that have already passed static inspection. It's a validation step, confirming or contradicting what static analysis already flagged, not the first thing every artifact goes through.

A key implication of how agent skills actually get compromised: pipeline integration can't be a one-time gate. A skill that passes every pre-deployment check today may behave differently tomorrow if a remote dependency updates silently or an MCP server changes its response, which is why scheduled re-scans and integrity checks matter alongside the initial gate.

Reasoning-based evaluation: on-demand escalation

The reasoning layer functions best as a conditional escalation path rather than a step every artifact passes through. It's most valuable exactly when static and dynamic signals are genuinely ambiguous, a skill whose documentation legitimately discusses security concepts in a way that trips keyword rules without any actual malicious intent behind it. In pipeline terms, that means invoking this layer only when the aggregate evidence score falls inside a defined uncertainty band, letting it adjudicate before a human reviewer needs to get involved, rather than running on every commit regardless of how clear-cut the earlier evidence already was.

Why this can't be a one-time check

Because agent skills depend on runtime dependencies, remote MCP servers, downloaded content, external APIs, that can change after a skill has already been approved, treating pipeline integration as a single upfront gate misses an entire category of risk. Hashing tool descriptions and dependency references at approval time, then alerting on any subsequent change, closes a meaningful part of that gap and aligns with how the broader industry has started addressing rug-pull style attacks on approved dependencies generally.

FAQ

Should dynamic analysis run on every pull request? Generally not, given the cost of spinning up isolated sandbox execution per artifact at scale. It's better suited to pre-deployment gates or a scheduled re-scan cadence than a per-commit check.

What should actually block a merge? High-severity static findings that meet a defined confidence bar, mirroring how existing SAST tooling already gates merges on unambiguous, high-confidence findings rather than every low-severity match.

How do you catch drift after a skill has already been approved? Through scheduled re-scans and by hashing tool descriptions and key dependency references at approval time, so any later change to an already-approved artifact triggers automatic re-review rather than going unnoticed.

Related reading: "From Alert to Action: Turning Agent Skill Scans Into SIEM-Ready Signal," "Trust Tiers: A Governance Framework for Agent Skill Allowlisting"