Question 1

How does SkillzBench security-scan agent skills?

Accepted Answer

Security scanning is a core step in SkillzBench's Verify pillar. Every skill is pinned to a commit SHA, validated, license-checked, security-scanned, and quality-judged before it receives a trust score. The scan results feed directly into the 0-100 trust score alongside quality, license, maintenance, and community signals.

Question 2

What percentage of agent skills actually have vulnerabilities?

Accepted Answer

Published research found that roughly of agent skills carry at least one vulnerability. Since skills are just SKILL.md instruction packages anyone can publish, there's currently no standard vetting — which is exactly the gap SkillzBench is building to close.

Question 3

Does SkillzBench scan skills that contain scripts?

Accepted Answer

At launch, SkillzBench's scope is instruction-only skills (SKILL.md plus text references). Script-bearing skills are listed link-out only, so you always know when a skill goes beyond scanned, text-based instructions.

Question 4

When can I start using SkillzBench?

Accepted Answer

SkillzBench is pre-launch and actively being built — the waitlist and newsletter are live now, but the product itself is not yet public. Joining the waitlist puts you first in line as the Discover, Verify, Benchmark, and Equip pillars come online.

Question 5

How is SkillzBench different from just reading a skill's GitHub page?

Accepted Answer

A GitHub page tells you what the author says. SkillzBench independently pins every version to a commit SHA, runs security and license checks, quality-judges the skill, benchmarks it in a sandbox with and without the skill, and publishes both a trust score and the Lift in percentage points — with money never touching scores.

Agent Security Scanning for Writers