> For the complete documentation index, see [llms.txt](https://docs.skillplus.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.skillplus.xyz/features.md). # Core Functions and Features SkillPlus gives the AI skill ecosystem a practical security layer. ## Product map ```mermaid mindmap root((SkillPlus)) Scan GitHub skills skills.sh links repository paths Analyze rule engine supply-chain graph multi-agent AI audit adversarial verification Decide calibrated ratings evidence with file:line recommendations Protect retroactive blacklist version-precise matching drift-aware re-scans Share badges public report links marketplace signals Integrate SDK API workflows CI and governance ``` ## Core feature matrix | Feature | What it does | Why it matters | | --------------------- | ----------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | | Skill scanning | Accepts a skill URL or repository path and analyzes the skill content. | Gives users a repeatable review before installation. | | Rule engine | Detects risk patterns such as unsafe commands, suspicious URLs, prompt injection, and credential access. | Deterministic, reproducible evidence that can be inspected line by line. | | Supply-chain graph | Extracts every dependency and network endpoint — from instructions and scripts, not just manifests — into a persistent graph. | Documentation-only skills have no manifest; their real supply chain lives in their instructions. | | Multi-agent AI audit | Four specialist analysts + a Lead Auditor produce an 8-category verdict with adversarial verification. | Independent lenses catch what a single pass misses; verification kills plausible-but-wrong findings. | | Retroactive blacklist | New malware advisories propagate across all historical scans and flip affected skills to High. | Point-in-time verdicts go stale; SkillPlus verdicts stay true. | | Recommendations | Every report with findings carries concrete remediation steps. | Authors get a fix path, not just a complaint. | | Reports | Rating, findings, evidence, per-agent analysis, and supply-chain snapshot in one page. | Makes security review understandable and shareable. | | Ratings | One calibrated risk signal, consistent across report, badge, homepage, and search. | No surface ever contradicts another. | | Badges | Live security status for READMEs, directories, and marketplaces. | Trust visible at the point of discovery — and it updates when intelligence changes. | | Skills directory | 125,000+ scanned skills, searchable and filterable by rating. | Helps users find safer skills. | | SDK/API | TypeScript and Python SDKs with deduplicated scan jobs. | Turns SkillPlus into infrastructure for marketplaces, CI, and governance. | ## What makes SkillPlus different | Strength | What SkillPlus provides | | -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | | Purpose-built skill model | Treats skills as agent-facing software: instructions, prompts, scripts, and workflow rules — not just repositories or packages. | | Three analysis layers | Deterministic rules + persistent supply-chain graph + multi-agent AI audit, each covering the others' blind spots. | | Retroactive protection | The only layer that re-scores history: when a package is confirmed poisoned, every dependent skill is flagged without re-scanning. | | Calibrated severity | "Score behavior, not capability" — ecosystem-normal patterns are context, so real alarms stay loud. | | Code-enforced floors | A confirmed poisoned dependency forces at least a High rating; no model output can talk it down. | | Evidence-first reports | Files, snippets, commands, URLs, and poisoned versions behind every finding. | | Actionable output | Recommendations tied to specific findings — pin this version, drop this flag, review that content. | | Platform-ready integration | SDK/API access so marketplaces, registries, CI systems, and governance workflows can use scan results programmatically. | ## Skill scanning Submit a GitHub or skills.sh skill and receive a security report pinned to the exact content version analyzed. Re-scans are drift-aware: unchanged content refreshes the AI audit in place; changed content triggers a full fresh scan so a report never mixes two versions of a skill. ## The rule engine Deterministic checks detect common risk patterns in AI skills, including: * command execution and unsafe shell usage * credential access * suspicious URLs and data-exfiltration patterns * prompt injection * persistence behavior * external downloads, suspicious archives or binaries These checks make every scan reproducible, and their output is fed to the AI layer — which also corrects rule-layer false positives (a documentation link flagged as an "external script" gets explained and dismissed, with the reasoning shown). ## The supply-chain graph Every scan contributes to a persistent graph of packages, versions, resolution precision, and network endpoints across the entire scanned ecosystem. The graph is what enables: * **Retroactive blacklisting** — advisories propagate to all historical scans instantly. * **Version-precise matching** — only actually-compromised versions match; popular packages are never blanket-banned. * **Ecosystem queries** — which skills depend on a given package? Which endpoints does a skill family contact? ## Multi-agent AI audit Four specialists (Structure & Capability, Supply Chain, Network & Egress, Behavior & MCP) review each skill independently. A Lead Auditor synthesizes their findings into eight fixed categories with an executive summary and recommendations. High-severity findings are adversarially re-verified before they reach the report. The result is displayed per agent, with severity indicator lights, finding counts, and evidence — so a reviewer can see not just the verdict, but each lens that produced it. ## Ratings One calibrated rating summarizes each skill: **safe · medium · high**. The same value drives the report header, the badge, the homepage list, and search — with supply-chain hits and admin whitelist decisions applied consistently everywhere. ## Badges ```md ![SkillPlus Security Report](https://skillplus.xyz/api/report//badge.svg) ``` Which renders as a live badge — this one is Microsoft's `entra-app-registration`, served straight from the API, so it reflects that skill's verdict right now: [![SkillPlus Security Report](https://skillplus.xyz/api/report/f17faaf8-239c-47fc-ab95-0d4bf5fc94ab/badge.svg)](https://skillplus.xyz/report/f17faaf8-239c-47fc-ab95-0d4bf5fc94ab) Badges are computed from the same pipeline as the report, including supply-chain overrides — a badge never claims "safe" for a skill whose report shows a poisoned dependency. ## Skills directory The directory organizes 125,000+ scanned skills for discovery: search, rating filters, popularity signals, and platform listings (skills.sh install counts). ![Skills directory](/files/QNeUCwdUDHgYC6RL7FEy) ## SDK and API integration The TypeScript and Python SDKs let developers and platforms use SkillPlus programmatically: * check a skill before installation * scan skills during CI * add security status to internal registries * embed reports and badges in marketplaces See the [SDK chapter](/sdk.md) for details. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.skillplus.xyz/features.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.