Question 1

How does SkillzBench security-scan AI agent skills like SKILL.md packages?

Accepted Answer

SkillzBench's Verify pillar pins every skill version to a commit SHA, then validates, license-checks, security-scans and quality-judges it. Launch scope covers instruction-only skills (SKILL.md plus text references); script-bearing skills are listed link-out only so you're never given a false sense of safety. The product is pre-launch — join the waitlist for early access.

Question 2

Can we control which skills each of our coding agents is allowed to use?

Accepted Answer

Yes. The Equip pillar provides one MCP server plus per-agent loadouts — you toggle skills and tools per agent, and the agent only sees what was chosen. Teams plans add org loadouts, allowlists and audit for organization-wide enforcement.

Question 3

How do you know a skill actually helps and isn't just safe?

Accepted Answer

The Benchmark pillar tests every skill in a sandbox with the same model, with and without the skill, and publishes the Lift in percentage points. Lift is always shown separately from trust scores, so security and usefulness are never conflated — and money never touches scores.

Question 4

What happens when an upstream skill changes after we've adopted it?

Accepted Answer

The Stay Current pillar tracks upstream changes, re-scans and re-benchmarks affected skills, and notifies you. Because every version is pinned to a commit SHA, you know exactly which version was vetted and what changed — closing the supply chain gap where exploits appear soon after disclosure.

Question 5

How is SkillzBench different from traditional vulnerability scanning tools?

Accepted Answer

Traditional scanners weren't built for agent instruction packages — they can't interpret the patterns and volume AI-generated content introduces. SkillzBench is an independent lab purpose-built for agent skills, combining security scanning, license checks, quality judging, sandbox benchmarking and per-agent loadout control in one control panel, with a 0-100 trust score from security, quality, license, maintenance and community signals.

Agent Security Scanning for Startup Teams