What Our Security Scanning Actually Does
- ✅ We DO: Check for dangerous install patterns (
curl | bash), malware-associated keywords, and verify GitHub presence - ❌ We DON'T: Review actual source code, test at runtime, or guarantee safety
- 🎯 Our goal: Give you useful signals to make informed decisions, not false confidence
How the Security Score Works (0-100)
Four components, each worth up to 25 points. Higher is better.
Command Risk
0-25 ptsChecks install commands for dangerous patterns like curl | bash, eval, or piped shell execution.
curl ... | bash
-25 pts
npm install package
+25 pts
Keyword Risk
0-25 ptsScans name/description for malware-associated terms: stealer, keylogger, backdoor, etc.
Provider Trust
0-25 ptsWeight based on how curated the source is. Curated marketplaces score higher than raw directories.
GitHub Presence
0-25 ptsVerifies repository exists, checks stars, activity, and archival status.
Security Status Labels
Actual runtime testing by our team. Reserved for future use - we're building real moat here.
Passed automated scans: no dangerous commands, no malware keywords, has GitHub. Not a guarantee of safety.
One or more automated checks triggered. Review the specific reasons before installing.
Insufficient information to assess. No GitHub repo, no install instructions, unknown provider.
Security by Provider
How different sources stack up in our automated scans.
Loading provider data...
Top Flagged Patterns
Most common reasons skills get flagged. These aren't necessarily malicious, but warrant review.
Loading pattern data...
Skills Requiring Attention
Skills with flagged patterns or insufficient verification. Review carefully.
Loading skills...
🔎 How to Verify a Skill Yourself
Don't trust our scans blindly. Here's a checklist for your own due diligence.
Check the GitHub Repository
- Is the repo public and accessible?
- When was the last commit? (Active maintenance is good)
- How many stars/forks? (Community trust signal)
- Are issues being responded to?
Read the Install Command
- Does it pipe to bash/sh? Big red flag
- Does it download and execute from a URL you can't inspect?
- Can you install via npm/pip instead of curl?
Review the Source Code
- Look for network calls - where is data being sent?
- Check for obfuscated code (base64, eval, etc.)
- Search for credential/token handling
Test in Isolation
- Run in a sandbox/VM first
- Use minimal permissions
- Monitor network traffic during first run
Report a Security Issue
Found a malicious skill or security vulnerability? Help us keep the ecosystem safe.
Report Security Issue