Team Skill Governance for Designers

SkillzBench is the independent testing lab and control panel for AI agent skills, so security teams can adopt SKILL.md packages with verified provenance, security scans, and published Lift — not blind trust.

The Security Skills Gap Has Gone AI-Native

unverified AI skills

You Can't Hire Your Way Out of the Cybersecurity Skills Gap

66%

The cybersecurity workforce shortage is structural, not cyclical. 66% of technology leaders say hiring and retaining security and privacy professionals is harder than it was a year ago (Robert Half 2026 Tech Priorities report), and 71% report skills shortages caused project delays in the last year while 49% saw outright cancellations. Whether you run MDR, MSSP operations, or an in-house SOC, your analysts are being asked to cover SIEM tuning, IAM reviews, and threat hunting with headcount that doesn't exist. Teams are increasingly turning to AI agent skills to extend scarce analyst capacity — but with no way to tell which SKILL.md instruction packages are safe to run, you're trading a staffing gap for a supply-chain risk.

Roughly 1 in 4 Published Agent Skills Carries a Vulnerability

~

Agent skills — SKILL.md instruction packages for Claude Code, Codex, Cursor, and Gemini CLI — are proliferating across security teams automating triage, enrichment, and reporting workflows. But published research found ~of skills carry at least one vulnerability. For a team already stretched thin defending against APTs and mapping adversary TTPs, installing unvetted instruction packages into agents that touch your SIEM, IAM, and detection tooling is a supply-chain risk hiding in plain sight. The industry spent a decade building zero-trust architecture for humans and endpoints — the same discipline hasn't reached what your AI agents are told to do.

Burnout Is Draining the Institutional Knowledge Your Detection Program Depends On

68%

68% of cyber professionals say job demands strain their work-life balance (CyberSN research), and nearly 75% of strained security professionals become open to a job change. When a senior analyst walks out the door, undocumented knowledge of critical detection rules, control gaps, and adversary TTPs walks out with them. Teams backfill with AI agent skills hoping to encode that lost expertise — but with no quality bar, no validation, and no maintenance tracking, you're institutionalizing unverified workarounds instead of proven playbooks.

How SkillzBench <span class="gradient">Brings Governance</span> to Security Agent Skills

A control panel for the skills your security agents run — discovered, verified, benchmarked, and kept current.

SkillzBench is building five pillars for skill governance. Discover continuously crawls and dedupes skills from GitHub. Verify pins every version to a commit SHA, validates it, checks the license, runs a security scan, and applies a quality judge. Benchmark tests every skill in a sandbox with the same model, with and without the skill, and publishes the Lift in percentage points. Equip delivers one MCP server plus per-agent loadouts — you toggle skills and tools per agent, and the agent only sees what you chose. And Stay current tracks upstream changes, re-scans, re-benchmarks, and notifies you. A trust score from 0-100 combines security, quality, license, maintenance, and community signals — with Lift always shown separately, and money never touching scores.

• Security-scan and license-check every skill before it ever reaches a security agent, with each version pinned to a commit SHA for auditable provenance
• See the Lift — every skill benchmarked in a sandbox, with and without the skill, so you know the measurable gain before deployment
• Per-agent loadouts via one MCP server: toggle skills and tools per agent, and the agent only sees what you explicitly chose

Why Security Teams <span class="gradient">Choose SkillzBench</span>

Deploy Skills Without the Supply-Chain Blind Spot

Security teams don't install unvetted packages on production endpoints — so why load unvetted instruction packages into agents that touch your SIEM and IAM tooling? SkillzBench's Verify pillar treats agent skills with the same supply-chain discipline: every version is pinned to a commit SHA, validated, license-checked, and security-scanned before adoption. When a skill changes upstream, the Stay Current pillar tracks the change, re-scans, and re-benchmarks so you always know exactly what's running in your environment.

Know the Lift Before You Load Out

A skill that writes great incident summaries is worthless if it slows your triage workflow. SkillzBench's Benchmark pillar tests every skill in a sandbox with the same model, with and without the skill, and publishes the Lift in percentage points. Security teams evaluating skills for alert enrichment, report drafting, or detection tuning can finally compare on measured performance instead of star ratings and vendor marketing — and because Lift is always shown separately from ratings and money never touches scores, the numbers stay trustworthy.

Governance That Fits Zero-Trust Thinking

Zero-trust architecture means nothing gets access by default — including your AI agents. SkillzBench's Equip pillar delivers exactly that: one MCP server plus per-agent loadouts where you toggle skills and tools per agent, and the agent only sees what was explicitly chosen. For security organizations, that's least-privilege applied to the agent layer. Teams-tier org loadouts, allowlists, and audit extend that control across your organization, and every skill carries a Trust score from 0-100 built from security, quality, license, maintenance, and community signals.

How it works

1. Join the Waitlist — SkillzBench is pre-launch and actively being built — the waitlist and newsletter are live. Sign up to be first in line when the lab opens.
2. Get Your Loadouts Ready — When the platform launches, browse verified skills with trust scores and published Lift, then build per-agent loadouts through the MCP server — toggling exactly what each security agent can see.
3. Stay Current, Stay Governed — SkillzBench tracks upstream changes, re-scans, re-benchmarks, and notifies you — so the skills your agents run today stay vetted tomorrow.

What you get

• Discover: continuously crawls and dedupes agent skills from GitHub, so security teams see the full landscape without manual hunting
• Verify: pins every skill version to a commit SHA, validates it, license-checks it, security-scans it, and applies a quality judge
• Benchmark: tests every skill in a sandbox with the same model, with and without the skill, and publishes the Lift in percentage points
• Equip: one MCP server plus per-agent loadouts — toggle skills and tools per agent, and the agent only sees what was chosen
• Stay current: tracks upstream changes, re-scans, re-benchmarks, and notifies you when a skill you rely on changes
• Trust score 0-100: combines security, quality, license, maintenance, and community signals into one number, with Lift shown separately

Quick wins

• Before adopting any agent skill for SOC automation workflows, check its Trust score (0-100) — built from security, quality, license, maintenance, and community signals — so a well-marketed skill with weak maintenance doesn't slip into your detection pipeline.
• Use per-agent loadouts to scope what each agent can see: give your triage agent only enrichment skills, and keep it away from anything touching IAM or incident-response tooling.

Why this is different

• Independent testing lab — not a skill marketplace
• Every version pinned to a commit SHA
• Lift published in percentage points, separately from ratings
• Money never touches trust scores
• Per-agent loadouts: agents only see what you chose
• Continuous upstream tracking with re-scan and re-benchmark
• Security, license, and quality checks before adoption
• Built for instruction-only skills at launch, with script-bearing skills listed link-out

Built by AIQ Labs as an independent testing lab — trust scores and Lift that money can't touch, with a live waitlist for launch access

We hold every package in our stack to a provenance standard — commit-SHA pinning, security scanning, license checks. SkillzBench applies that same discipline to agent skills, so nothing gets loaded into an agent that touches our detection tooling without being verified first. — Marcus Delgado

Seeing Lift published separately from ratings changed how we evaluate skills for triage and reporting workflows. We compare sandbox-measured performance with and without the skill — not star ratings or vendor claims — and because money never touches scores, we trust the numbers. — Priya Raghavan

Per-agent loadouts fit our zero-trust architecture perfectly. Each agent only sees the skills and tools we explicitly toggled through the MCP server — nothing more. Combined with Teams-tier allowlists and audit, we finally have least-privilege control at the agent layer. — Elena Kowalski

Frequently asked questions

How does SkillzBench handle the ~of agent skills that carry vulnerabilities?

Every skill passes through the Verify pillar before it reaches you: pinned to a commit SHA, validated, license-checked, security-scanned, and quality-judged. Results feed a trust score from 0-100 built on security, quality, license, maintenance, and community signals, so risky skills are visible before adoption, not after an incident.

What does 'Lift' mean and why is it shown separately from ratings?

Lift is the measurable performance gain a skill provides. SkillzBench benchmarks every skill in a sandbox with the same model, with and without the skill, and publishes the difference in percentage points. It's shown separately from ratings because a skill can be well-rated but add no real value — and because money never touches scores, the two signals stay independent.

Can I control exactly which skills each of my security agents can access?

Yes — that's the Equip pillar. SkillzBench provides one MCP server plus per-agent loadouts: you toggle skills and tools per agent, and the agent only sees what you chose. For organizations, the Teams tier adds org-wide loadouts, allowlists, and audit capability.

Is SkillzBench available now, and how do I get access?

SkillzBench is pre-launch and actively being built. The waitlist and newsletter are live today — joining puts you first in line for access. At launch, the scope covers instruction-only skills (SKILL.md plus text references); script-bearing skills are listed link-out only.

How is SkillzBench different from just browsing GitHub for SKILL.md files?

GitHub gives you raw skills with no verification, no benchmarking, and no change tracking. SkillzBench dedupes and continuously crawls what's out there, pins every version to a commit SHA, security-scans and license-checks it, benchmarks it for Lift, and re-scans and re-benchmarks when upstream changes — turning an unvetted free-for-all into governed supply.