Question 1

How does SkillzBench security-scan agent skills for vulnerabilities like prompt injection risks?

Accepted Answer

SkillzBench's Verify pillar runs every skill version through validation, license checks, security scanning, and quality judgment, with each version pinned to a commit SHA. Note that launch scope covers instruction-only skills (SKILL.md plus text references); script-bearing skills are listed link-out only, so you can review them without SkillzBench executing them.

Question 2

Can SkillzBench help with shadow AI detection when developers add skills to Claude Code or Cursor without approval?

Accepted Answer

SkillzBench's Equip pillar gives you a control plane: one MCP server plus per-agent loadouts where users toggle skills and tools per agent, and the agent only sees what was chosen. Combined with Teams-tier org loadouts, allowlists, and audit, it gives managers visibility into which skills are enabled across which agents.

Question 3

What does the Trust score measure, and can vendors pay to improve it?

Accepted Answer

The Trust score ranges 0-100 and is computed from security, quality, license, maintenance, and community signals. Money never touches scores — Lift is always shown separately from ratings, and SkillzBench operates as an independent testing lab rather than a promotional marketplace.

Question 4

Is SkillzBench available now, and how do we get access for our security team?

Accepted Answer

SkillzBench is pre-launch and actively being built — the waitlist and newsletter are live today. Security and product teams can join now to get early access as the Discover, Verify, Benchmark, Equip, and Stay-current pillars come online, with benchmark-as-a-service available for priority runs.

Question 5

How is this different from just reviewing skills on GitHub ourselves?

Accepted Answer

Manual GitHub review gives you a snapshot; SkillzBench gives you a pipeline. It continuously crawls and dedupes skills, pins versions to commit SHAs, security-scans and license-checks each one, benchmarks Lift in a sandbox with the same model, and then tracks upstream changes with re-scan, re-benchmark, and notifications — so a skill that was safe last month can't silently drift.

Agent Security Scanning for Product Managers