> For the complete documentation index, see [llms.txt](https://docs.skillplus.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.skillplus.xyz/why-skillplus.md). # Why Choose SkillPlus SkillPlus is built for a new category of software risk: AI agent skills. Traditional security tools were designed for packages, dependencies, containers, applications, and infrastructure. AI skills are different. They are often small, fast-moving, and instruction-heavy. They can combine natural language, scripts, external resources, and workflow assumptions in ways that traditional scanners were not designed to interpret. SkillPlus focuses on this new layer directly — and adds something no point-in-time scanner has: **retroactive supply-chain protection**. ## The opportunity ```mermaid flowchart TD A[More capable agents] --> B[Skills become plugins] B --> C[More skills published] C --> D[Trust before install] D --> E[SkillPlus security layer] ``` The more powerful agents become, the more important skill trust becomes. SkillPlus is positioned at that trust boundary. ## A real case: the litellm poisoning In March 2026, `litellm` versions **1.82.7 and 1.82.8** on PyPI were compromised in a supply-chain attack (advisory **MAL-2026-2144**): credential-harvesting malware that stole cloud keys and planted persistent backdoors. Several published AI skills instruct the agent to `pip install litellm` — without pinning a version. Here is what security tools said about one such skill: | Tool | Verdict on the affected skill | | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | | Gen Agent Trust Hub | **Safe** | | Socket | **Pass** | | Snyk | Warn — but only a generic "third-party content exposure" note; the poisoned dependency was never mentioned | | **SkillPlus** | **High** — supply-chain blacklist hit on `pypi:litellm`, poisoned versions 1.82.7 / 1.82.8 named in the report, remediation step provided | The reason is structural, not a matter of scan quality. A per-skill snapshot scanner looks at the skill's own files at scan time; "this dependency has a known-malicious version" is intelligence that arrives **later** and lives **outside** the skill. SkillPlus keeps a persistent dependency graph across all scanned skills, so new intelligence re-scores history automatically. ## Why existing tools are not enough Security for AI skills sits between several existing categories: code scanning, dependency scanning, marketplace listings, and audit status pages. Each is useful, but none fully answers the question: should this skill be allowed to influence an AI agent? | Existing approach | What it is good at | Gap for AI skills | SkillPlus advantage | | ------------------------------------ | ------------------------------------------ | --------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | | Manual README or source review | Human judgment and context | Slow, inconsistent, easy to miss hidden files, scripts, prompt behavior, or external references | Repeatable reports with findings, evidence, rating, multi-agent AI audit, and recommendations | | Dependency and supply-chain scanning | Known package vulnerabilities in manifests | Package-centric; a documentation-only skill has no manifest to scan, and verdicts are frozen at scan time | Extracts dependencies from skill *instructions* (install commands, scripts) and re-scores them retroactively when new advisories land | | Generic static analysis | Detecting risky code or content patterns | Noisy without skill-specific context | Skill-specific rules plus a multi-agent AI review with adversarial verification and false-positive correction | | Marketplace listings and ratings | Discovery, popularity, community signals | Popularity does not equal security — high-reputation packages get compromised too | Security ratings backed by evidence, independent of popularity | | Aggregated audit status pages | Quick visibility into review coverage | Status without evidence, anatomy, or a fix path | Detailed reports, evidence snippets, per-agent findings, recommendations, badges, SDK | ## Point-in-time vs. living intelligence ```mermaid flowchart LR subgraph Snapshot scanners A[Scan once] --> B[Verdict frozen at scan time] B --> C[World changes → verdict silently wrong] end subgraph SkillPlus D[Scan once] --> E[Dependency graph persisted] E --> F[New advisory arrives] F --> G[Historical verdicts re-scored automatically] end ``` ## Calibrated, not alarmist A scanner that cries wolf gets ignored — and then its real alarms are missed too. SkillPlus applies an explicit calibration principle: **score behavior, not capability**. Ecosystem-normal patterns (invoking a well-known CLI via `npx`, installing a package the user asked for, documentation links) are reported as context at low severity, not inflated into warnings. A finding of medium severity or higher must have a concrete threat path. The escalation budget is spent where it belongs: a confirmed-compromised dependency, a typosquat, a pipe-to-shell from an unknown host, or content that manipulates the agent itself is loud — and code-enforced floors guarantee it can never be talked down, not even by the AI layer itself. ## Static evidence plus semantic understanding plus supply-chain memory SkillPlus combines three complementary layers: ```mermaid flowchart LR A[Skill content] --> B[Deterministic rule checks] A --> C[Supply-chain graph extraction] A --> D[Multi-agent AI audit] B --> E[Concrete evidence] C --> F[Persistent dependency & endpoint graph] D --> G[Context, intent, verified severity] E --> H[Readable security report] F --> H G --> H F -.->|new advisories re-score history| H ``` This matters because a raw warning list is not enough. Users need to know what an issue means, whether it is a real risk today, and whether it may become one tomorrow. ## Clear reports for trust decisions SkillPlus reports are designed for decision-making. A user should be able to answer: * What does this skill do? * What risks were found — and what is just inherent to its purpose? * What evidence supports each finding? * Did independent AI review confirm the severity? * Is any dependency in the chain confirmed compromised? * What exactly should be fixed before this skill is trusted? ## Designed for product and platform integration SkillPlus is not only a website. The SDK lets platforms and teams integrate scan results directly into: * internal developer portals * CI pipelines * skill registries * marketplaces * onboarding workflows * enterprise agent governance That makes SkillPlus useful both as a user-facing product and as infrastructure for the broader AI skill ecosystem. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.skillplus.xyz/why-skillplus.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.