• A skill installer may legitimately download and execute another skill.
• A note formatter doing the same thing without disclosure is a different story.
• Offensive-security commands may be expected in a pentesting skill, but that still matters when the skill can autonomously extract credentials or modify applications.

SkillPlus therefore asks whether a behavior is necessary, disclosed, and aligned with the skill's stated purpose.

We flag instructions that manipulate the agent's context, scripts that read secrets, workflows that transmit repository data to unknown endpoints, deceptive behavior, and known-poisoned dependency chains.

But when a capability is inherent to the skill's purpose, we do not automatically inflate the risk rating. We can pass the behavior while still attaching a permission advisory.

The goal is not to produce the longest attack-surface checklist. It is to support a useful trust decision without training users to ignore constant false alarms.

Same skill, different question, different verdict

Different security tools can inspect the same skill and reach different conclusions because they optimize for different questions.

Example 1: find-skills

Vercel official find-skills meta-skill exists to discover and install other skills. Fetching third-party content is therefore part of its job.

SkillPlus sees the third-party-content risk. The difference is how it judges that risk in context. If every discovery tool becomes Medium simply because it can discover content, the rating loses its ability to discriminate.

Example 2: an Android pentesting skill

We also tested a real offensive-security skill containing APK modification, RASP bypass, Frida instrumentation, and hardcoded-secret extraction.

Here, SkillPlus moves in the opposite direction. A tool that equips an autonomous agent with offensive capability and extracts secrets deserves a prominent warning.

This is not about declaring that another tool is universally right or wrong. The tools answer different questions. SkillPlus is optimized for:

Should this skill be allowed to influence an agent with real authority?

How the v2 scanner works

A scan is not one prompt. It is a multi-stage pipeline:

1
skill
2
  → four specialist agents in parallel
3
    (structure · supply chain · network · behavior)
4
  → a synthesis agent produces one verdict
5
  → adversarial verification tries to refute every high-severity finding
6
  → code-enforced safety invariants apply the final hard limits
7

The specialists examine the skill from different angles, which helps catch cross-cutting behavior that a single review can average away.

Adversarial verification then argues against each high-severity finding. Findings that survive this challenge are more likely to deserve attention; plausible-but-wrong alarms are removed or downgraded.

Finally, safety-critical decisions are enforced in code rather than left to model judgment:

• A confirmed-poisoned dependency is forced to High.
• A high-severity finding cannot be silently dropped.
• A failed or refused model call cannot produce a fake Safe verdict.

This combination gives us semantic judgment where context matters and deterministic guarantees where compromise is unacceptable.

The supply chain remembers

A scan should not become stale the moment it finishes.

For every skill, SkillPlus persists its declared, lockfile, and transitive dependencies, together with the network endpoints it references, into a queryable graph.

If a package or domain is later confirmed malicious — including an OSV MAL- advisory or an internal blacklist match — that intelligence can reverse-propagate to every affected skill, including historical reports, without rescanning the original source.

That matters because supply-chain compromise is often discovered after installation. A one-time local snapshot can tell you what was known during the scan. A living threat-intelligence layer can answer what is known now.

The privacy model is also straightforward for integrations: a client can send a lookup key, such as a skill URL, package coordinate, or domain, rather than sending its source code.

Available today

• URL scanning: GitHub and skills.sh URLs, including common pasted variants such as www, nested slugs, query strings, fragments, and SSH remotes.
• Evidence-backed reports: rating, eight fixed threat categories, confidence, file:line evidence, false-positive guidance, report URL, and badge.
• Full skills.sh baseline: 9,592 leaderboard skills scanned with the v2 pipeline.
• Published SDKs: npm and PyPI package skillplus, version 0.2.0, MIT licensed.
• Platform integration: query existing intelligence, trigger a scan, wait for completion, and consume supply-chain and multi-agent results through the SDK.

1
import { SkillPlus } from "skillplus";
2

3
const skillplus = new SkillPlus({ apiKey: "skp_..." });
4
const result = await skillplus.query({
5
  repoUrl: "<https://www.skills.sh/vercel-labs/skills/find-skills>",
6
});
7

8
if (result.status === "found") {
9
  console.log(result.report.verdict);
10
}
11

Where it is going

We started with skills.sh because it is an important discovery layer for the Vercel agent ecosystem and gives us a real, fast-moving corpus of skills to secure.

The durable part of SkillPlus — the dependency graph, blacklist, threat intelligence, and deterministic extraction tools — is separated from the orchestration layer. Our next architectural step is deeper integration with Vercel Eve while keeping that security intelligence portable for other agent platforms and CI workflows.

The longer-term goal is simple: before an agent installs or executes a skill, it should be able to perform one fast trust lookup.

Ready to Scan Your First Skill

What is SkillPlus? | Skill Plus Contact: skillplus@proton.me