Question 1

How does SkillzBench security-scan an AI agent skill before I install it?

Accepted Answer

SkillzBench continuously crawls and dedupes skills from GitHub, then pins every version to a commit SHA and runs validation, license checks, security scans and quality judging. Results feed a 0-100 trust score built from security, quality, license, maintenance and community signals. Note that SkillzBench is pre-launch — the waitlist is live and the scanning pipeline is what will be offered at launch.

Question 2

Does SkillzBench handle script-bearing skills, or only instruction-only SKILL.md packages?

Accepted Answer

Launch scope covers instruction-only skills — SKILL.md packages plus text references. Script-bearing skills will be listed link-out only, so you can discover them but SkillzBench won't execute or fully vet their code at launch.

Question 3

Can I prove to auditors which skills my agents are actually running?

Accepted Answer

Yes — that's the design. Every skill version is pinned to a commit SHA, loadouts are defined per agent so each agent only sees what was explicitly enabled, and Teams-tier plans are planned to include org loadouts, allowlists and audit capabilities for exactly this kind of governance need.

Question 4

How do I know a skill actually improves my agent, not just that it's safe?

Accepted Answer

Every skill is benchmarked in a sandbox with the same model, with and without the skill, and the Lift is published in percentage points. Lift is always shown separately from trust ratings, so safety and usefulness never get conflated — and money never touches scores.

Question 5

How is this different from just pulling skills off GitHub myself?

Accepted Answer

On GitHub you can't tell which skills help and which are risky — published research found roughly carry at least one vulnerability. SkillzBench gives you one deduped, verified catalog with security scans, license checks, commit-SHA version pinning, published Lift benchmarks, per-agent loadouts via one MCP server, and automatic re-scans when upstream skills change.

Agent Security Scanning for Founders