Zero supply-chain incidents. Every shared skill scanned and verified.

Your team's skills, verified
and synced to every AI agent.

SkillSafe scans, verifies, and delivers AI agent skills to Claude Code, Cursor, Windsurf, Codex, and every tool your team uses. Scanning is free for everyone — no signup required.

Paste any public GitHub URL. No signup required.

Building with a team? Set up your org Why SkillSafe?

Prefer a desktop app? Get the SkillSafe desktop app for macOS, Windows, and Linux.

Works with your favorite AI tools

Claude Code
Cursor
Windsurf
Codex
Gemini
OpenCode
OpenClaw
Kilo Code
Droid
Antigravity
Cline
Roo
Goose
Copilot
Kiro
Trae
AMP
Aider AI tool logo
Aider
VS Code
Skills Indexed
24,400+
Scanned
22,800+
Verified
15,859
Publishers
2,300+
Scan Reports
27,300+
Threats Caught
84

Top Skills

Trending now → View all

1,184+ malicious skills were confirmed in the ClawHavoc campaign.

In early 2026, security researchers confirmed 1,184+ malicious AI skills across 12 compromised publisher accounts, distributing Atomic Stealer malware, stealing credentials, and exfiltrating data via ClickFix social engineering. SkillSafe was built so this cannot happen here — every skill is scanned before sharing and independently re-verified on install, with cryptographic tamper detection between publish and download.

Labeling vs. Gating.

Scanning a skill at install time tells you it was clean when you downloaded it. It doesn't tell you it's the same file the publisher uploaded — or that critical findings will actually stop the install.

No scanning

  • Anyone publishes without security review
  • No verification at any point
  • Community flags damage after it happens
  • No integrity check on downloaded archives

Scan-and-label

open registries that scan at install time

  • Scanned at install — not before publishing
  • Critical findings shown as warnings, install still proceeds
  • No publisher-side scan before the skill is shared
  • No tamper detection between publish and download

SkillSafe: scan-and-gate

  • Publisher scans before sharing — not after
  • Consumer independently re-scans on install
  • Critical verdicts block the install automatically
  • Cryptographic tree hash detects any tampering in transit

Full capability comparison →

Key Features

Dual-Side Verification

Skills are scanned automatically when viewed. AI review classifies findings and flags false positives. Tampered skills are detected via cryptographic tree hashes.

Cryptographic Tree Hashes

Every archive is SHA-256 hashed into an immutable tree hash. If a single byte changes, verification fails with a critical verdict.

Semantic Versioning

Strict semver enforcement and version yanking. Install exactly the version you need, every time.

Share Links

Share skills via revocable links with expiration controls. Private by default — share when you're ready, revoke anytime.

Built for AI Tools

Works with Claude Code, Cursor, Windsurf, Codex, Gemini, OpenCode, OpenClaw, Cline, Roo, Goose, GitHub Copilot, Kiro, Trae, AMP, Aider, VS Code, Antigravity, Droid, and Kilo Code. One registry across all your AI agents — no vendor lock-in, no separate extensions needed.

Free to Use

Save up to 50 private skills per day for free. Share with cryptographic verification at no cost. Upgrade only when you need more storage or team features.

How It Works

1

Auto-Scan

Submit a GitHub URL or visit a skill page. SkillSafe runs 12 security checks automatically — no installation required. Results are cached and updated when files change.

2

AI Reviews

AI classifies each finding — separating real threats from false positives. Assigns a security score and produces a recommendation with reasoning for every finding.

3

Integrity Verified

Cryptographic tree hashes (SHA-256) ensure files haven't been tampered with. Every version is immutable — any change produces a different hash.

Latest from the Blog

View all posts

Manage your team's skills in one place.

Organization workspaces are available today: a private shared registry, team roles and invites, domain verification, and security scanning on everything your developers install. Enterprise plans add shared storage, higher limits, and priority support.

Create an organization Talk to enterprise sales

See pricing for plan details.

Secure your skills in 30 seconds.

Download the SkillSafe desktop app or run npx skills add to install your first verified skill in seconds — every skill is security-scanned and cryptographically verified.

Explore Skills Documentation