Documentation

Each new version of a skill goes through the same pipeline, whether it arrived from a registry crawl or a vet-skills detonate upload:

• Static analysis — the bundle is parsed for credential-path reads, network calls to undeclared hosts, writes to agent memory or instruction files, tool-description shadowing, filesystem reach beyond the project, and unpinned dependencies (rules AST01–AST07).
• Honeypot run — the skill executes in an isolated sandbox with a decoy home directory (tagged SSH keys, cloud and registry credentials), a recording egress proxy, and a syscall trace, across setup, task and adversarial scenarios. Any decoy that appears on the wire is attributable to the run.
• Coverage — every run records how far it got: full (tool list or agent task observed), startup only, not started, install only, or static only. The label is never shown without it when the run was partial.
• Score — behaviour, declarations and supply-chain findings combine into a 0–100 score and a label: Verified (clean), Caution (findings a policy may sandbox or require approval for), Blocked (credential exfiltration, undeclared egress with secrets, or memory tampering). Versions with only static findings are capped at Caution until the honeypot has run.
• Re-detonation — scored versions are swept again on a schedule, and every new release is diffed against the previous one. A verdict that moves shows up as drift for the teams that have it installed.

Every verdict is also a signed attestation (DSSE, Ed25519) over the bundle's sha256, verifiable offline against /.well-known/killerskills-keys.json; vet-skills verify checks it and vet-skills lock pins what was attested. Verdict pages show the findings, the trace, the declarations the skill made and whether the sandbox honoured them. Publishers can claim a skill to be notified before a verdict changes, and dispute a finding from the verdict page.

An organization adds a policy and visibility on top of the free verdicts:

• Policy — minimum score, what happens on Caution and on unscored versions, per-behaviour actions, publisher allow/block lists. Versioned YAML; agents pick up the latest version on their next check.
• Inventory — every skill and MCP server installed by every enrolled agent, with its current verdict, who installed it, and whether it violates policy today.
• Approvals — installs that need a human land on the Approvals page with the full report; decisions are recorded.
• Drift alerts — when a verdict moves on something your team runs, with one-click removal requests to the affected machines.
• Watched MCP servers — hosted MCP endpoints your agents connect to are probed read-only on every crawl. Their tool names, descriptions and input schemas are snapshotted; when the surface changes, the new descriptions are run through the same prompt-integrity rules as a SKILL.md and a tool surface changed alert is raised. The vet-skills hook reports any remote server added with claude mcp add automatically.
• Runtime — with the guard on each machine, every MCP server the team's agents launch runs with placeholders instead of credentials, every host and tool call is recorded, a host a version never contacted before raises an alert, destructive tool calls can be held for a decision in Slack, and a version you revoke stops launching fleet-wide at its next start. Policy clause runtime: — network, new_host, secrets, blocked_versions, tools.
• Audit log — every decision, approval, policy publish and enrollment, exportable.
• Review packs — a date-bounded evidence bundle for your access review: what was listed on enrolled devices, what the guard observed (sessions, destinations, tool decisions), what people approved and how their identity was known, what the organization attests. Seven deterministic rules (missing approval, lapsed approval, version change, unexpected destination, denied or held calls, identity or policy gaps, coverage gaps) produce review items; a reviewer records a disposition for each; an admin finalizes, which freezes the records and binds the acknowledgment to their hash. Downloads are single-use links; the ZIP holds CSVs, a manifest with per-file hashes and known gaps, and a readable PDF whose every statement cites a record. Nothing is inferred: older records whose policy version or approver identity was not captured export blank and are listed as gaps. Supports evidence gathering for your own review and audit process; it is not a certification.
• Settings — required-guard mode (machines without the guard install it at their next sync and show as non-compliant), retention for runtime data, single sign-on over OpenID Connect (Okta, Entra, Google Workspace, any issuer with discovery; optionally required for the org's email domain), and SIEM streaming of every audit record and alert (JSON, Splunk HEC, Datadog, CEF) on Enterprise.

Enforcement starts in observe (decisions logged, nothing blocked) and is switched to enforce from the Policy page when the team is ready. Start a 14-day trial — no card required.

The same data the CLI uses is available over HTTPS; no key is needed for public verdicts.