Question 1

How does SkillzBench assess the security risk of a Claude Code or Codex skill before my team installs it?

Accepted Answer

SkillzBench's Verify pillar pins every skill version to a commit SHA, then runs validation, license checks, security scanning, and quality judging. Each skill also receives a 0–100 Trust score built from security, quality, license, maintenance, and community signals, so you can triage risk before anything touches a production agent. This is what SkillzBench is building and will offer at launch.

Question 2

Can I prove to a client that a specific agent skill actually improves performance?

Accepted Answer

Yes — that's the Benchmark pillar. Every skill is tested in a sandbox with the same model, with and without the skill, and the Lift is published in percentage points. Because Lift is always shown separately from ratings and money never touches scores, you can present the numbers to clients as independent evidence rather than vendor marketing.

Question 3

What happens when a skill's maintainer pushes an update that introduces a vulnerability?

Accepted Answer

The Stay Current pillar tracks upstream changes to skills you use, re-scans and re-benchmarks them, and notifies you. Combined with commit-SHA version pinning, you always know exactly which version you evaluated and when its risk profile changed — a defensible position for any audit or incident review.

Question 4

Is SkillzBench available now, and what will it cost a small security consultancy?

Accepted Answer

SkillzBench is pre-launch and actively being built; the waitlist is live today. At launch, the pricing hypothesis includes a generous free tier, a Pro tier (~$9–15/mo) for more agents and unlimited enabled skills, and a Teams tier (~$15–25/seat/mo) with org loadouts, allowlists, and audit capabilities suited to consultancies managing multiple client environments.

Question 5

How is this different from just reading a skill's GitHub repo and community reviews?

Accepted Answer

Manual review gives you opinions at a point in time; SkillzBench gives you measured, version-pinned evidence. Every skill is deduped from GitHub, pinned to a commit SHA, security-scanned, license-checked, benchmarked with and without the skill, and continuously re-checked when upstream changes. Plus, per-agent loadouts let you enforce that an agent only sees the skills and tools you've explicitly enabled — something a GitHub README can never do.

Skill Audit & Risk Report for Consultants