Static analysis parses source code, configuration, instructions, or packaged files and checks them against structural rules, data-flow models, type systems, or known risky patterns. Because the target is not executed, the analysis can be safer than dynamic testing for unknown software.
Static analysis can find many problems early, but it cannot observe every runtime behavior or external effect. Results can include false positives and missed issues, so important software also needs dependency review, sandboxed testing, runtime monitoring, and human judgment.
ELI5
Static analysis checks software by reading its files instead of running it. This can reveal suspicious instructions or coding mistakes without giving unknown code a chance to act.
For example, a skill scanner can notice that a script contains a command for uploading private files. The scanner can warn the user before the skill is installed or executed.
