Every skill is scanned
before it reaches you
AI agent skills execute code, access files, and interact with APIs. That's powerful - and it demands rigorous vetting.
See the scan in action
When a skill is submitted, our pipeline instantly begins analyzing source code, dependencies, permissions, and runtime behavior. Results appear on every listing.
Three-tier security status
Every skill receives a security status after automated review. Visible on every listing - so you always know what you're installing.
Pass
Zero findings. No code injection, no data exfiltration, no unauthorized access. Safe to install and use immediately.
Warn
Minor findings detected - broad file access or uncommon API usage. All findings disclosed on the listing for full transparency.
Block
Critical security issues found. Code injection, credential theft, or data exfiltration. Rejected - never reaches the marketplace.
What we scan for
Nine security layers. Every skill. No exceptions.
File Type Validation
Only approved file types are accepted. Executables, binaries, and suspicious archives are rejected immediately.
Pattern Scanning
Dangerous code patterns detected: shell injection, eval() usage, dynamic execution, credential access, and data exfiltration.
ClamAV Signature Scan
Industry-standard antivirus scanning against known malware signatures, trojans, and embedded threats.
Dependency Audit (Snyk)
All third-party packages checked against known vulnerability databases for outdated or compromised dependencies.
Supply Chain (GuardDog)
Detects typosquatting, dependency confusion, and compromised upstream packages in the supply chain.
Socket.dev Dependency Risk
Detects risky dependency behavior including install scripts, network access, shell execution, and obfuscated code in packages.
VirusTotal Analysis
Cross-referenced against 70+ antivirus engines via VirusTotal for comprehensive malware detection.
AI Security Review
Semantic analysis powered by AI to catch prompt injection, auth bypass, obfuscated logic, and data exposure risks.
Agent-Specific Checks
Agents undergo additional review for permission scope, tool chaining behavior, and autonomous execution boundaries.
How the review process works
Every submission. Same pipeline. No exceptions, no fast-track.
Submission
Creator submits via CLI. Package, manifest, and source code are uploaded.
Automated Scan
Static analysis, dependency audit, permission checks, behavioral detection. Minutes.
Manual Review
Warnings escalate to human review. Our team inspects flagged patterns and decides.
Listed or Rejected
Clean → Verified. Minor → Warning. Dangerous → Blocked.
Open findings. Clear reporting.
Security works best in the open. Every decision we make is visible to you.
Findings on every listing
Any security findings - even minor ones - are shown directly on the skill page. You see exactly what was flagged and why before you purchase.
Scanned before listing
Every version of every skill passes through the full nine-layer security pipeline before it appears on the marketplace. No exceptions.
Report a concern
Found something suspicious? Email contact us. We investigate every report and respond within 24 hours.
Creator accountability built in
Every skill is tied to an authenticated creator account with a public profile and reputation history.
Authenticated Account
Creators sign up through Clerk with email confirmation and complete a public profile. No anonymous listings.
Authenticated Account
Every creator authenticates via Clerk using GitHub OAuth or email verification. Public profiles are linked to authenticated identities.
Automated Security Scan
Every submission passes through our 9-layer automated security pipeline - static analysis, pattern detection, ClamAV, VirusTotal, and AI review.
Ongoing Reputation
Ratings, reviews, and scan history build a public reputation. Violations lead to suspension and delisting.
Your purchase is protected
Secure payments, unique license codes, and account-tied licensing.
Secure Payments
All transactions processed through Stripe with PCI-DSS Level 1 compliance. Your payment details never touch our servers - they go directly to Stripe's secure infrastructure.
Unique License Codes
Every purchase generates a unique license code in XXXX-XXXX-XXXX format.
Codes are tied to your account and can be regenerated if compromised.
One license, all compatible platforms.
Account-Tied Licensing
Each license is tied to your account and works across all compatible platforms. If a code is compromised, contact us and we'll regenerate a new one instantly.
A note on security
No automated security system is perfect. While our scanning pipeline catches the vast majority of threats, we strongly recommend reviewing the source code of any skill before installing it in production environments. Our security statuses are a starting point - not a guarantee.
When in doubt, inspect the code yourself or contact us for a detailed report.
Frequently Asked Questions
How does the security scanning work?
Every submitted skill goes through automated static analysis, dependency auditing, permission scope verification, data exfiltration detection, credential access checks, and behavioral analysis. The entire pipeline runs in under 2 minutes.
What happens if a skill fails the scan?
Skills with critical findings (code injection, credential theft, data exfiltration) are blocked and never reach the marketplace. Skills with minor findings receive a warning status with full disclosure on the listing page.
Can I see the security report for a skill?
Yes. Every skill listing shows its security status (Verified, Warning, or Blocked) along with any findings. You always know what you're installing before you buy.
What if I find a vulnerability after installing?
Report it through our contact page using the "Security Report" option. We investigate every report within 24 hours and work with creators to issue patches.
Are skills re-scanned after initial review?
Skills are scanned at publish time -- every version goes through the full pipeline before listing. If you discover a vulnerability after install, report it through our contact page and we investigate within 24 hours.
Is the scanning automated or manual?
The primary scan is fully automated across nine security layers. If the automated scan flags anything, it escalates to our team for manual review before a final decision is made.
How are creators vetted on AgentPowers?
Creators sign up with authenticated accounts via Clerk. Public profiles show their ratings and review history. Every submitted skill goes through the full automated security scan before listing.
What happens if a license code is compromised?
Contact us and we'll regenerate a new license code instantly. The old code is revoked and your access is uninterrupted. Codes are tied to your account, not shared publicly. Reach out via our contact page.
Install with confidence
Every skill on AgentPowers has been scanned and verified. Browse the marketplace or start creating your own.