The skill goes through us before it reaches them. AI Skill Check inspects an agent skill before you install it, and tells you what it would have done.
- Every skill checked before it reaches a workstation
- The whole download-and-execute chain, not just the first link
- A verdict you can enforce: allowed, blocked or conditional
A skill is code someone else wrote, running with your agent’s permissions
The skill itself
The instructions and files it ships with: the permissions it asks for out loud, and the ones it takes quietly.
Everywhere it points
The links inside it resolved and followed to their destination, including wherever a second stage gets fetched from.
What it does when it runs
Detonated inside a sandboxed agent, so run-time behaviour appears somewhere it cannot reach anything of yours.
What we check, before your agent runs it
- Manifests and instructions
- The prompt text and metadata, read for instructions aimed at the agent rather than the task. The ones that tell it to forget what came before.
- Requested permissions
- File, network, shell and credential access against what the skill claims to do. A formatter that wants your environment variables is the finding.
- Referenced URLs
- Every link inside resolved and checked, including the ones assembled at run time from fragments that look harmless apart.
- The payload chain
- The full download-and-execute chain, hop by hop. The first is clean; what matters is what the third one fetches.
- Runtime behaviour
- The skill run in a sandboxed agent. What it reaches for, writes and sends is observed, not inferred.
- Where it came from
- The repository behind it - ClawHub, playbooks.com, skills.sh, GitHub, GitLab - and whether the publishing account has any history.
- What changed since last time
- A skill safe at one version and not the next. Re-checked on update: the install you approved is not the code that runs.
How it works
Submit
You send us the skill, or the repositories you install from. Nothing has to be installed first.
Analyse
ESET’s engine takes the mechanical work: content, permissions, references, the payload chain, and the sandboxed run. Then we do our own: what the engine flagged but could not settle, what the publisher has shipped before, and what the skill would reach in your environment.
Decide
You get a verdict with the reasoning behind it: allowed, blocked, or allowed on conditions you can actually apply. The verdict is ours, not a score forwarded from a scanner.
What you get
A verdict per skill, and a register your agents read from
Every skill comes back allowed, blocked or conditional, with what we found and why it mattered, written for a team lead with no security background. The verdicts build a register of what you permit. The answer to “can I install this?” already exists.
Find out what your team is about to install
Send us a skill your people want. We will tell you what it does before it goes near your data.