How to audit an agent skill before installing it: A practical checklist for reviewing a SKILL.md and its bundled scripts for prompt injection, exfiltration, over-privilege, and supply chain risk, mapped to OWASP AST10.
What skill scanners catch, and what they miss: An honest account of automated agent skill scanning: detection rates, the Trail of Bits bypasses, false positives, and how to use scanner output without trusting it.
Reading a skillscan.io report: How to interpret a skill page on skillscan.io: the verdict, severity levels, finding categories, analyzer sources, confidence, and scan history.
For researchers: using the skillscan.io dataset: How to download, cite, and reproduce the skillscan.io dataset of AI agent skill security scan results, including schema, history, and known caveats.