Question 1

Does SkillzBench detect prompt injection vulnerabilities in agent skills?

Accepted Answer

SkillzBench security-scans every instruction-only skill (SKILL.md plus text references) as part of its Verify pipeline, and published research found roughly of skills carry at least one vulnerability. Skills bearing scripts are listed link-out only at launch, so executable code never passes through unvetted.

Question 2

How does the Trust score work and can authors pay to boost it?

Accepted Answer

The Trust score runs 0-100 and combines security, quality, license, maintenance, and community signals. Money never touches scores, and Lift — the measured performance difference with and without a skill — is always shown separately from ratings.

Question 3

What does 'pinned to a commit SHA' mean for supply chain security?

Accepted Answer

Every skill version SkillzBench verifies is pinned to a specific GitHub commit SHA. That means the exact code you reviewed and scanned is the exact code you equip — and if upstream changes, SkillzBench tracks it, re-scans, re-benchmarks, and notifies you.

Question 4

Is SkillzBench available now, and what will it cost students?

Accepted Answer

SkillzBench is pre-launch and actively being built; the waitlist and newsletter are live today. The pricing hypothesis includes a generous free tier, with Pro at roughly $9-15/month for more agents and unlimited enabled skills.

Question 5

How is this different from just browsing skills on GitHub or a marketplace?

Accepted Answer

GitHub shows you a README; SkillzBench shows you verification. You get continuous crawling and deduping, commit-SHA pinning, license checks, security scans, quality judgments, sandboxed Lift benchmarks with the same model, per-agent loadouts through one MCP server, and upstream change notifications — all from an independent lab where money never touches scores.

Agent Security Scanning for Students