> For the complete documentation index, see [llms.txt](https://docs.skillplus.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.skillplus.xyz/readme.md).

# What is SkillPlus?

![SkillPlus](/files/moP2GoX0x4gmQi3Xoo2u)

SkillPlus is a security intelligence platform for AI agent skills.

AI skills are becoming the plugin layer for agentic software. They give coding assistants, automation agents, and enterprise copilots new abilities: reading files, running commands, calling APIs, operating workflows, and shaping how an agent behaves.

That power creates a new trust problem.

A skill is not just a package. It can contain instructions, scripts, links, hidden files, workflow rules, and behavioral guidance that influence an AI agent. A malicious or careless skill can ask an agent to read credentials, run unsafe commands, send data to unknown endpoints, or ignore important user and system instructions. And even an entirely honest skill can quietly pull in a **poisoned dependency** — a package that was later compromised in a supply-chain attack.

SkillPlus helps users, teams, and platforms understand those risks before a skill is installed, shared, or embedded into an AI workflow — **and keeps protecting them afterwards**, because skill risk changes over time even when the skill itself doesn't.

Website: <https://skillplus.xyz>

## SkillPlus in one picture

```mermaid
flowchart LR
    A[AI skill ecosystem<br/>GitHub · skills.sh · marketplaces · internal repos]
    B[SkillPlus<br/>security intelligence layer<br/>rules + supply-chain graph + multi-agent AI]
    C[Developers<br/>install with confidence]
    D[Teams<br/>review before approval]
    E[Authors<br/>publish trust badges]
    F[Platforms<br/>embed security signals]

    A --> B
    B --> C
    B --> D
    B --> E
    B --> F
```

## The problem SkillPlus solves

The AI skill ecosystem is growing quickly, but trust infrastructure is still early.

Developers discover skills from GitHub, skills.sh, community posts, internal repositories, and emerging marketplaces. Many skills are useful, but users often have to trust them by reading a README or quickly scanning source files.

That is not enough for agentic tools.

AI skills can introduce risks such as:

| Risk area               | What can go wrong                                                                                                                           |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| Secrets and credentials | A skill may ask the agent to read keys, tokens, SSH files, or environment variables.                                                        |
| Command execution       | A skill may run unsafe shell commands or remote scripts.                                                                                    |
| Data movement           | A skill may send code, files, or private context to unknown endpoints.                                                                      |
| Prompt behavior         | A skill may try to override user intent, hide instructions, or manipulate the agent.                                                        |
| Supply chain            | A skill may depend on packages that are — or **later become** — compromised. A snapshot scan taken before the compromise will never see it. |

SkillPlus turns that uncertainty into a structured security report — and into a living intelligence layer that reacts when the ecosystem changes.

## What SkillPlus does

Every scan runs three complementary analysis layers:

1. **Deterministic rule engine** — fast, reproducible checks for known risk patterns: unsafe commands, credential access, suspicious URLs, prompt-injection language, persistence behavior, malformed skill structure.
2. **Supply-chain graph extraction** — every dependency and network endpoint the skill references is resolved to precise ecosystem coordinates (`pypi:litellm`, `npm:skills`, …) with version-resolution precision, and persisted into a queryable graph.
3. **Multi-agent AI security audit** — four specialist AI analysts (Structure & Capability, Supply Chain, Network & Egress, Behavior & MCP) review the skill independently; a Lead Auditor synthesizes their findings into an 8-category verdict; high-severity findings are adversarially re-verified; and a set of **code-enforced invariants** guarantees the final rating never silently under-reports what was found.

The output is clear security intelligence:

* a risk rating that is consistent across every surface (report page, badge, homepage, search)
* evidence-backed findings with `file:line` citations
* a per-agent breakdown of the AI audit, with severity indicators
* **actionable recommendations** — not just what is wrong, but how to fix it
* a supply-chain snapshot with any confirmed-malicious hits called out, including the exact poisoned versions
* shareable report pages, badge URLs, and SDK access

## The retroactive moat

The persistent supply-chain graph is what makes SkillPlus fundamentally different from point-in-time scanners.

When a package is confirmed compromised — for example the real **litellm 1.82.7 / 1.82.8 poisoning of March 2026** (advisory MAL-2026-2144, credential-harvesting malware) — SkillPlus does not need to re-scan anything. The blacklist entry propagates across **every historical scan in the graph**, and every skill that depends on the poisoned package flips to **High** everywhere: report page, badge, homepage list, search. Skills that other scanners had marked "Pass" at scan time get flagged the moment the intelligence lands.

```mermaid
flowchart LR
    A[New malware advisory<br/>e.g. MAL-2026-2144 litellm] --> B[Version-precise blacklist entry]
    B --> C[Propagation over the historical graph]
    C --> D[Every affected skill flips to High<br/>report · badge · homepage · search]
```

That is protection no snapshot scan can provide, no matter how good its analysis is.

### What it looks like in a real report

Microsoft's own `entra-app-registration` skill (455k installs) is pure documentation with no executable payload, and it was clean when scanned. It reads **High Risk** today for exactly one reason: a package in its install instructions later picked up a confirmed malicious advisory, and the blacklist reached back into the existing report.

![Supply-chain section of a real report — npm:axios, MAL-2026-2307](/files/jMlUSdyR58apLnnga5aK)

[Open the full report →](https://skillplus.xyz/report/f17faaf8-239c-47fc-ab95-0d4bf5fc94ab)

Every agent's findings stay visible too — not just the final verdict:

![Agent Analysis — five agents, each with its own findings](/files/IOcpLNQ3p7ZpH119cj3m)

## Coverage

SkillPlus has scanned **125,000+ skills** across GitHub and skills.sh. Install counts refresh hourly, and any skill can be scanned on demand by URL.

![Live counts on the SkillPlus homepage](/files/UU3EGjM8xSKb2O4eGiSU)

## Who SkillPlus is for

| Audience                   | Value                                                                                         |
| -------------------------- | --------------------------------------------------------------------------------------------- |
| Developers                 | Check a skill before installing it into a local agent environment.                            |
| Teams                      | Review third-party skills before they enter internal workflows or agent platforms.            |
| Skill authors              | Publish security reports and badges to build user trust — and get concrete remediation steps. |
| Platforms and marketplaces | Integrate skill security signals into discovery, installation, and governance workflows.      |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.skillplus.xyz/readme.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.