How we review every skill.
Skills are instructions your AI can follow. Before a new skill or update appears in the catalog, we scan the instructions and have a person review them.
From submission to publication
Nothing goes straight from a creator to the live catalog.
- 01
Submit
A creator sends the instructions. The skill stays unpublished.
- 02
Scan
We check for hidden prompts, data leaks, secrets and unsafe commands.
- 03
Review
A person reads the submission before deciding if it can go live.
- 04
Publish
Only approved skills marked clean appear in the catalog.
What we check for
These are the main risks our scan and review are designed to catch.
Hidden instructions
Attempts to override your AI's rules or conceal its actions.
Data exfiltration
Directions to send private files or customer data elsewhere.
Credential harvesting
Requests for passwords, API keys, private keys or seed phrases.
Destructive commands
Commands that delete, format or overwrite data.
Remote code execution
Directions to download and run outside scripts.
Obfuscation
Encoded or invisible content that could hide unsafe instructions.
After approval
Updates are checked again
Changed instructions go through scanning and review before the new version is published.
Clean listings get a badge
The “Scanned & vetted” badge appears only on listings marked clean.