SAFETY
A skill is a plain text file your AI follows. That is what makes it useful, and it is also why nobody uploads one straight into the store. Every file goes through an automatic scan on upload and a human read before it can go live. All 13 live listings have passed both.
Hidden instructions. Text written to override your AI's own rules, or to tell it to hide what it is doing from you.
Data exfiltration. Anything that sends your files, keys or customer data to an outside webhook or server.
Credential harvesting. Files that ask you to paste an API key, password, private key or seed phrase.
Destructive commands. Shell that deletes, formats or overwrites anything on your machine.
Remote code execution. Downloading a script from the internet and running it.
Obfuscation. Base64 blobs, encoded payloads and invisible characters used to hide the above.
1. Scan. The moment a creator uploads, the file is checked against the list above. Anything in that first group is rejected on the spot and never reaches the store.
2. Human read. Anything the scanner flags is held back, unpublished, until someone here reads the file end to end.
3. Re-check on change. A file cannot be swapped out after approval. A new version is a new upload and goes through the same two steps.
4. You can read it too. Every listing shows part of the real file before you buy, and what you download is plain text you can open in any editor.
Found something that looks wrong in a file you bought? Mail hello@buyskillset.com and we will pull it the same day.