Introducing SkillSafe: Why AI Coding Skills Need a Verified Registry

Editor’s note (July 2026): This post has been updated to reflect the current install paths — the AI SkillSafe desktop app and npx skills add — which replaced the MCP-based setup and the legacy skillsafe CLI commands described in the original version.

In January 2026, security researchers found 341 malicious skills on a popular AI agent registry. One of them — bundled with Atomic Stealer malware — had been downloaded over 7,700 times before anyone noticed. The skills looked legitimate. They passed no security scan because there was none to pass.

This is the state of AI skill distribution today.

Skills have a supply chain problem

AI agents like Claude Code, Cursor, Windsurf, Codex, Gemini, and OpenCode are becoming the primary way developers write software. Skills extend these tools with specialized capabilities — deployment workflows, code review checklists, framework scaffolding, API integrations.

But the way skills get shared looks a lot like the early days of npm, before lockfiles and audit existed. Authors publish to open registries or share raw GitHub URLs. Consumers install with no scanning, no integrity verification, and no way to confirm that what they downloaded matches what the author actually published.

The surface area is real. A skill can contain arbitrary code that runs inside your development environment — the same environment that has access to your source code, credentials, and file system. A malicious skill doesn’t need a sophisticated exploit. It just needs subprocess.run() and a URL.

What SkillSafe does

SkillSafe is a skill registry with verification built into the protocol, not bolted on after the fact.

The core mechanism is dual-side verification:

1. The publisher scans their skill locally before sharing. The scanner runs AST-based static analysis and produces a structured report along with a SHA-256 tree hash of the entire archive.
2. The consumer downloads the skill and independently re-scans it. This produces a second report and tree hash from their side.
3. The server compares both reports. If the tree hashes don’t match — meaning even a single byte was changed between publish and install — the verdict is critical and the desktop app blocks the installation automatically.

This isn’t trust-the-publisher verification. Both sides scan independently, and the server validates that they agree.

How it works

There are two ways to install, and neither requires any setup:

• AI SkillSafe desktop app (macOS / Windows / Linux) — click View in AI SkillSafe app on any skill page. The app downloads the skill, re-scans it locally, verifies it against the publisher’s report, and writes the files into your tool’s skill directory.
• Command line — every SkillSafe skill is cloneable via git, so Vercel’s skills CLI works natively:

npx skills add https://api.skillsafe.ai/{ns}/{name}

(For programmatic and agent access, the legacy MCP endpoint at api.skillsafe.ai/mcp still exists, but it’s no longer the recommended install path.)

From there, the workflow is straightforward:

• Scan — paste any GitHub-hosted skill URL into the web scanner (no account needed), or let the desktop app scan a local skill directory.
• Save — save a skill privately to the registry from the desktop app or via the API. No scan required for private skills.
• Share — create a revocable share link from the desktop app or API. Sharing requires email verification and a scan report.
• Install — npx skills add … for a plain install, or the desktop app for install with automatic verification.

Every install through the desktop app triggers a full re-scan on the consumer’s machine. The app submits its independent report to the server, which compares it against the publisher’s. You get one of three verdicts:

• Verified — tree hashes match, findings are consistent. Safe to use.
• Divergent — tree hashes match but findings differ (e.g., scanner version mismatch). Surfaced as a warning and logged.
• Critical — tree hashes don’t match. The archive was tampered with. The desktop app blocks the installation.

What makes this different

Dual-side verification, not trust-the-publisher. Most registries scan once at upload and then trust the result forever. SkillSafe makes the consumer an independent verifier. If the archive changes between publish and install — whether from a compromised server, a man-in-the-middle, or a malicious update — the consumer’s scan catches it.

Save-first, share-second. Skills are private by default. You can save unlimited versions to the registry with no email verification and no scan report required. Sharing is a separate, opt-in step that creates revocable, expirable links. This keeps the adoption friction near zero while enforcing security gates where they matter — at the point of distribution.

Install where you already work. The SkillSafe desktop app (macOS / Windows / Linux) handles install via a one-click skillsafe://install?ns=…&name=…&version=… deep link from any skill page. Prefer the command line? Every SkillSafe skill is cloneable via git, so Vercel’s skills CLI works natively: npx skills add https://api.skillsafe.ai/{ns}/{name} auto-detects Claude Code, Cursor, Windsurf, and Codex.

Immutable version history. Once a version is saved, it can’t be overwritten. New content requires a new version number. This gives every skill a complete, auditable history — you can always trace back to what was published and when.

What we scan for

The scanner runs multiple passes over every file in a skill archive:

• Command injection — AST parsing for subprocess, os.system, eval, exec, child_process, and shell execution patterns
• Data exfiltration — outbound HTTP requests, DNS lookups, environment variable access that sends data externally
• Obfuscation — base64-encoded payloads, encoded strings that decode to executable code, suspicious entropy patterns
• Secrets — hardcoded AWS keys, GitHub tokens, private keys, and other credentials detected via pattern and entropy analysis
• Prompt injection — heuristic pattern matching in Markdown files for jailbreak attempts and instruction override patterns

Each finding is severity-rated (critical, high, medium, low, info) and included in the structured scan report that feeds into the verification comparison.

Get started

Browse the registry and click View in AI SkillSafe app on any skill — the desktop app re-scans locally, dual-verifies against the publisher’s scan, and writes files into your tool’s skill directory.

Or install from the command line:

npx skills add https://api.skillsafe.ai/{ns}/{name}

Vercel’s skills CLI auto-detects your tool (Claude Code, Cursor, Windsurf, Codex) and writes files to the correct location. From there you can scan additional skills, save your own to the registry, and optionally share them with revocable links.

Read the full documentation for API details, or check out the security model for a deeper look at how verification works under the hood.