Safe AI Deployment: A Launch Checklist

AI Is Shipping Faster Than It's Being Secured

Enterprise AI is moving to production faster than safety practices can keep up. Generative AI spending by enterprises hit $37B in 2025 — a 3.2x jump from $11.5B the year before — and AI deals now reach production at nearly twice the rate of traditional SaaS (47% vs. 25%), according to Menlo Ventures' enterprise research. That velocity is a win for the business, but it's also the setup for the problem this checklist exists to solve.

Here's the uncomfortable part: most organizations deploying AI say trust matters, but far fewer actually do anything about it. IBM's global adoption survey of more than 8,500 IT professionals found that 85% agree consumers prefer companies with ethical AI practices and 83% say explainability is important — yet only 27% of deployers take concrete steps to reduce bias, 37% track data provenance, 41% explain AI decisions, and 44% have ethical AI policies at all.

That's the intention-action gap, and it's the single biggest risk in any AI launch. Teams ship the capability, skip the controls, and discover the gap later — usually after an incident. The gap widens further as deployments shift from simple prompting to agentic workflows. OpenAI's enterprise report describes a move "from asking models for outputs to delegating complex, multi-step workflows," which means AI systems now hold permissions: file access, credentials, network connections.

And the newest part of that attack surface is barely governed at all. Agent skills — the instruction packages that extend Claude Code, Codex, Cursor and similar tools — have become a supply chain nobody is vetting. An academic analysis of 31,132 skills found that 26.1% contain at least one vulnerability, with data exfiltration in 13.3% and privilege escalation in 11.8%. Snyk's independent audit of nearly 4,000 skills found 13.4% with at least one critical issue, and researchers concluded the ecosystem isn't theoretical risk — "it's an ecosystem already under attack."

The numbers tell a consistent story:

• Enterprise genAI spend tripled year-over-year to $37B in 2025, with 76% of use cases purchased rather than built in-house.
• Only 27–44% of AI deployers take concrete trustworthy-AI actions, despite 83–85% agreeing trust and explainability matter.
• Roughly one in four agent skills carries a vulnerability, and skills bundling executable scripts are 2.12x more likely to be risky than instruction-only ones.
• Real exploitation has already happened: a weaponized "GIF Creator" skill was used to deliver ransomware in December 2025.

Launching AI without a checklist means betting that your team will be the exception — that the skill you grabbed last week is in the safe majority, that the permissions you granted were scoped, that someone is accountable when something breaks. The research suggests most teams aren't making that bet consciously; they're making it by default. The rest of this article turns that default into a deliberate, item-by-item launch process.

One practical note before we dive in: verification is exactly the layer most teams skip because it's tedious. This is why SkillzBench is building a free directory that security-scans, version-pins, and sandbox-benchmarks agent skills before your agent ever loads them — so the vetting work doesn't depend on everyone remembering to do it.

The Hidden Risk in Your Launch: Agent Skills

Most launch checklists cover models, data, and prompts — and completely miss the fastest-growing attack surface: the agent skills your team installs in seconds. These SKILL.md instruction packages, now used across Claude Code, Codex, Cursor, and Gemini CLI, are the least-governed corner of AI deployment.

The numbers are sobering. An academic analysis of 31,132 skills found that 26.1% contain at least one vulnerability, with 5.2% showing high-severity patterns strongly suggesting malicious intent. Snyk's independent audit of 3,984 skills found 13.4% carry at least one CRITICAL issue, and 76 confirmed malicious payloads — 8 of which were still live on ClawHub at publication.

This isn't hypothetical. In December 2025, a "GIF Creator" skill was weaponized to silently download and execute MedusaLocker ransomware. As Snyk's researchers put it, "this isn't theoretical risk, it's an ecosystem already under attack."

The structural problem is what researchers call the "consent gap." One approval — often granted casually during setup — hands a skill persistent permissions to read and write files, execute shell commands, open network connections, and access credentials in environment variables. No further prompts. No time limit. Skills inherit the agent's full permissions, and publishing barriers are as low as a SKILL.md file and a one-week-old GitHub account.

Not all skills carry equal risk, either. The research found that skills bundling executable scripts are 2.12× more likely to contain vulnerabilities than instruction-only skills. When you're vetting what your agents can do, the shape of the skill matters as much as its source.

Your pre-launch skill review should cover:

• Scan every installed skill for vulnerabilities, prompt injection, and hardcoded secrets — 10.9% of ClawHub skills contained hardcoded credentials
• Pin each skill to a specific commit SHA, since attack logic can live on attacker-controlled infrastructure and change after your review
• Prefer instruction-only skills over script-bundled ones where possible
• Toggle permissions per agent and per tool, so each agent only sees what was explicitly chosen
• Re-scan on every upstream change, not just at install time

This is exactly the verification layer SkillzBench is building: a free, independent directory where every skill is version-pinned, security-scanned, license-checked, and benchmarked in a sandbox before your agent ever loads it — plus a free MCP connector so agents only see the skills you deliberately equip.

If your launch checklist doesn't have a line item for agent skills, add one today. Your credentials, files, and network are already counting on it.

The Pre-Launch Checklist: 5 Steps to Vet and Scope

Most teams deploy AI agents first and worry about permissions later — a sequence the data says is backwards. With 42% of enterprise-scale companies now actively deploying AI, the launch checklist has become the last line of defense, not a formality.

1. Treat every skill as an untrusted supply-chain component. Security scanning before launch is non-negotiable when academic research analyzing 31,132 skills finds 26.1% carry at least one vulnerability and 5.2% show high-severity patterns suggesting malicious intent. Anthropic's own guidance recommends installing only from trusted sources and thoroughly auditing anything else. A separate Snyk audit of 3,984 skills found 13.4% with at least one critical issue — and 76 confirmed malicious payloads. This is the verification layer SkillzBench is being built to provide: pinning each skill version to a commit SHA, scanning it, and benchmarking it before your agent ever loads it.

2. Scope permissions by capability, not blanket consent. Researchers describe a "consent gap": one approval grants persistent file, network, and download access without further prompts. Skills inherit shell access, credentials, and memory by default. Prefer instruction-only skills over script-bundled ones, which are 2.12× more likely to contain vulnerabilities.

3. Mandate governance items before go-live. Concrete steps lag stated intent: while 83% say explainability matters, only 44% have ethical AI policies, 41% explain decisions, and 37% track data provenance. Bake these into the checklist as requirements, not aspirations.

4. Run privacy review and role-based training. Data privacy is the top inhibitor for non-adopters at 57%, and only 34% of organizations reskill employees for AI tools. Train by role, not in bulk.

5. Plan continuous re-scanning, not one-time review. Attack logic can live on attacker-controlled infrastructure and change after approval, and daily skill submissions grew 10x in weeks — from under 50 to over 500. A launch checklist that ends at go-live is already stale.

The pre-launch work is unglamorous: scan, scope, govern, train, monitor. Skip it, and your fastest deployment becomes your largest exposure.

How to Put the Checklist Into Practice

A checklist only protects you if it survives contact with reality — the moment a skill updates, a new agent joins the stack, or someone installs something on a Friday afternoon. The good news is that putting these safeguards into practice comes down to four concrete habits.

Pin skill versions to commit SHAs. The single most common failure mode is testing one version and running another. Attack logic can live on attacker-controlled infrastructure and change after review, according to Snyk's audit of the skills ecosystem, so "latest" is a moving target you never actually verified. Pinning every skill to a specific commit SHA means what you tested is exactly what runs in production.

Prefer instruction-only skills over script-bundled ones. This is one of the few risk factors with hard numbers behind it: academic research analyzing 31,132 skills found that skills bundling executable scripts are 2.12× more likely to contain vulnerabilities than instruction-only skills. When two skills do the same job, choose the one that tells the agent how to work rather than the one that ships code to run.

Toggle per-agent loadouts. The research describes a "consent gap": once approved, a skill gains persistent permissions to read files, download code, and open network connections without further prompts. The countermeasure is capability-based scoping — each agent sees only the tools and skills explicitly chosen for it, nothing more. A coding agent doesn't need your email skill; a research agent doesn't need shell access.

Monitor upstream changes continuously. Skill submissions jumped from under 50 per day to over 500 in a matter of weeks, and 26.1% of analyzed skills carry at least one vulnerability. One-time review isn't a strategy. In practice, a working monitoring loop looks like:

• Track upstream commits on every pinned skill and flag changes automatically
• Re-run security scans whenever a skill's source changes, not just at first install
• Re-benchmark in a sandbox with the same model, with and without the skill, to confirm it still helps
• Notify the owner when a pinned version drifts, fails a scan, or loses its Lift

This is exactly the verification layer SkillzBench is building: a free directory where every skill version is pinned to a commit SHA, security-scanned, license-checked, and sandbox-benchmarked — plus a free MCP connector with per-agent loadouts, so each agent only ever sees what you selected for it. Because it tracks upstream changes and re-scans automatically, the "stay current" discipline stops depending on someone remembering to check. You can join the waitlist at skillzbench.com to browse and test vetted skills at launch — everything on the platform, including the MCP connector and benchmark results, is free.