Why security matters for AI skills

AI skills are different from regular software. When you install a skill, it gets access to your AI assistant's full capabilities: reading files, running terminal commands, accessing environment variables, and making network requests.

This means a malicious skill could potentially:

  • Read sensitive files (API keys, credentials, private code)
  • Run harmful commands on your computer
  • Send your data to external servers
  • Inject instructions that change how your AI behaves

This is why AgentPowers exists: to be the trust layer between you and the skills you install. Learn more about what AI skills are and how they work.

The 8-layer security pipeline

Every skill submitted to AgentPowers goes through an automated 8-layer security scan before it's listed:

  1. File type validation: Checks for dangerous file types that shouldn't be in a skill package
  2. Pattern scanning: Regex checks for known dangerous patterns (env variable harvesting, obfuscation, shell injection)
  3. ClamAV malware scan: Industry-standard antivirus signature matching
  4. Dependency vulnerability scan (Snyk): Checks Python and npm dependencies for known CVEs
  5. Supply chain analysis (GuardDog + Socket.dev): Detects supply chain attacks in dependencies
  6. VirusTotal scan: Multi-engine malware scanning across 70+ antivirus engines
  7. AI security review: Anthropic-powered semantic analysis for prompt injection, auth flaws, and data exposure
  8. Agent-specific checks: For agents, additional analysis of tool access patterns and instruction safety

The entire pipeline runs automatically in under 2 minutes.

What the trust levels mean

After scanning, every skill receives one of three statuses:

  • Verified (green): Passed all security checks with no findings. Safe to install.
  • Warning (orange): Passed with minor findings that are disclosed on the listing. Review the findings before installing.
  • Blocked (red): Failed security checks. Not listed on the marketplace. You cannot install blocked skills.

Security findings are visible on every skill's listing page. You can see exactly what was checked and what was found before you decide to install.

What you can do to stay safe

Even with automated scanning, here are best practices:

  • Check the security status before installing any skill. Look for the green "Verified" badge.
  • Read the description and understand what the skill does before installing.
  • Check the creator's profile. Verified publishers with multiple skills and good ratings are more trustworthy.
  • Review security findings for any "Warning" skills. The findings are listed on the skill page.
  • Keep skills updated. Ask your AI assistant to check for updates regularly.