Security and Trust & Safety

Every skill is security scanned before it goes live, and every new listing is checked by a person. The Trust & Safety card on each skill page shows what the skill needs.

On the Trust & Safety card

• Security scanned: the result of the last scan and when it ran.
• Requires: logos of the services the skill needs.
• Permissions required: terminal or shell, reading files, writing files, browser, network access or environment variables, plus allowed hosts and file scopes.
• Listed and Updated dates.

What the scan checks. File structure, file types, dangerous commands, secrets, environment harvesting, network access, obfuscation and prompt injection. See Review and approval for what fails each check. Updates are scanned too.

The scan has limits. It's a best-effort check. It reads every text file your agent can receive, but it can't promise a skill is free of every problem. Read the permissions before you use a skill, especially ones with terminal or network access.

Report a problem. A skill that behaves badly: info@agensi.io. A vulnerability in Agensi itself: security@agensi.io. We acknowledge within 5 business days. See agensi.io/security/disclosure.