Question 1

How does SkillzBench security-scan agent skills differently from traditional vulnerability scanning tools?

Accepted Answer

Traditional scanners are built for CVEs, endpoints and credentialed network scans — they don't parse SKILL.md instruction packages at all. SkillzBench is building purpose-built security scanning for agent skills: every version is pinned to a commit SHA, then license-checked, security-scanned and quality-judged before it earns a trust score. That targets the ~of skills that published research found carry at least one vulnerability.

Question 2

Can I prove to a client exactly which skill version their agent was running?

Accepted Answer

Yes — that's the core of the Verify pillar. Every skill version SkillzBench lists is pinned to a commit SHA, and the Stay current pillar tracks upstream changes, re-scans and re-benchmarks when a skill changes. You get a defensible audit trail instead of 'whatever was on GitHub that day.'

Question 3

Does SkillzBench handle script-bearing skills, or only instruction-only skills?

Accepted Answer

At launch, the scope is instruction-only skills — SKILL.md plus text references. Script-bearing skills are listed link-out only, so you can still discover them but SkillzBench won't claim to have scanned or benchmarked them. This keeps every trust score honest about what was actually tested.

Question 4

What's the rollout timeline, and how do I get access for client engagements?

Accepted Answer

SkillzBench is pre-launch and actively being built — the waitlist and newsletter are live now. Join the waitlist to be notified as security scanning, benchmarking and the MCP server come online. Teams-tier features like org loadouts, allowlists and audit are on the roadmap for organizational rollouts.

Question 5

Why trust SkillzBench's scores over a skill author's own claims or a GitHub star count?

Accepted Answer

SkillzBench is an independent testing lab run by AIQ Labs. Trust scores are computed from security, quality, license, maintenance and community signals, and Lift is always published separately from ratings. Money never touches scores — creators can pay for a Creator tier or priority benchmark runs, but that never influences a score or a Lift result.

Agent Security Scanning for Consultants