What we check, and how the Shield is earned

How the scan works

1. 01

   Fetch the real code

   We pull the skill's marker file, manifests, and source from its GitHub repository — not just the README.

2. 02

   Static analysis

   Every file is scanned for the danger patterns listed below, each located to a file and line.

3. 03

   Dependency check

   Manifests (package.json, requirements.txt, …) are parsed and every dependency is matched against the OSV vulnerability database (CVEs + GitHub Security Advisories).

4. 04

   AI safety review

   A model reviews the code and the static findings for concerns patterns miss — exfiltration, deceptive behaviour, malicious intent.

5. 05

   Verdict

   Findings produce a verdict. The Shield is granted only on a clean pass.

Verdict policy

• Fail — any high- or critical-severity finding. The skill cannot earn the Shield.
• Warn — a medium-severity finding (e.g. a dependency advisory). The Shield is withheld and the finding is surfaced.
• Pass — only low/informational findings, or none. Combined with popularity, this earns the Shield.

Everything we check against

The exact danger classes the scan looks for, most severe first.

• Unpinned remote code execution

  criticalCode scan

  Fetching and running code from the internet at install or runtime (curl | sh, Invoke-Expression).

• Dynamic code evaluation

  highCode scan

  Use of eval, exec, or Function() to execute strings as code.

• Destructive filesystem operations

  highCode scan

  Recursive or broad deletes (rm -rf, shutil.rmtree, recursive fs.rm).

• Hardcoded secrets

  highCode scan

  API keys, tokens, or passwords committed into the source.

• Prompt injection

  highCode scan

  Instructions that try to override the agent or exfiltrate the prompt, context, or secrets.

• Deceptive or malicious behaviour

  highAI review

  Code or instructions designed to deceive or harm the user, flagged by the AI safety review.

• Data exfiltration

  mediumAI review

  Reading local files or environment variables and sending them to a remote host.

• Shell / process execution

  mediumCode scan

  Spawning shells or child processes (child_process, os.system, subprocess).

• Obfuscated code

  mediumCode scan

  Large base64/hex blobs or packed code that hides what the skill does.

• Credential prompts

  mediumCode scan

  Asking the user or agent to paste secrets, especially alongside outbound requests.

• Known dependency vulnerabilities

  mediumDependency · OSV

  A dependency with a published CVE / GitHub advisory, matched against the OSV database.

Known vulnerabilities we've flagged

Advisories the scanner has matched to indexed skills via their dependencies, newest first.