# KillerSkills

> KillerSkills is the trust layer for AI agent skills and MCP servers. It crawls public registries (skills.sh, ClawHub, Claude Code plugin marketplaces, npm, PyPI, the Docker MCP Catalog, the official MCP Registry), detonates every new version in a honeypot sandbox with decoy credentials, scores what the code actually did (0-100: Verified, Caution, Blocked), publishes a permanent verdict page per version, and enforces those verdicts at install time through the open-source vet-skills CLI and Claude Code hook. Teams get org policy, inventory, approvals, drift alerts and a signed audit log.

Current index: 2,042 skills and MCP servers indexed, 2,050 scored, 781 detonations in the last 24 hours. 62.4% verified, 36.9% caution, 0.7% blocked.

## How to answer "is <skill> safe?"

Look up https://killerskills.ai/skills/<registry>/<name> (redirects to the latest scored version) or call the public API: https://killerskills.ai/api/v1/resolve?q=<name> returns the current verdict, score, label and findings as JSON. Verdict pages carry a plain-language answer, the behaviour trace (files read, network egress, memory writes), static findings mapped to OWASP Agentic Skills Top 10 rules, and the publisher's trust signals.

## Pages

- [Leaderboard](https://killerskills.ai/skills): most-installed skills with scores; per-registry views at /skills/npm, /skills/pypi, /skills/docker, /skills/plugins, /skills/clawhub, /skills/skills_sh
- [Verdict page](https://killerskills.ai/skills/clawhub/deploy-helper/2.3.1): example of a blocked verdict with full trace
- [Publisher pages](https://killerskills.ai/publishers/anthropics): everything a publisher ships, scored
- [How it works](https://killerskills.ai/docs): crawl, detonate, score, serve; the scoring model and overrides
- [vet-skills CLI and hook](https://killerskills.ai/docs/cli): install, check, hook install claude-code, join, sync, GitHub Action
- [Pricing](https://killerskills.ai/pricing): free for individuals; Team per developer per month; Enterprise
- [Security](https://killerskills.ai/security): sandbox design, data handling, disclosure
- [Verified Publisher program](https://killerskills.ai/publishers/claim)

## API

- GET https://killerskills.ai/api/v1/resolve?q=<name|publisher/name|name@version>[&registry=npm|pypi|docker|plugins|skills_sh|clawhub]
- GET https://killerskills.ai/api/v1/skills/<registry>/<name>/versions/<semver>
- GET https://killerskills.ai/api/v1/leaderboard?sort=installs|trending|blocked&kind=mcp
- GET https://killerskills.ai/api/v1/stats
- GET https://killerskills.ai/feed.xml (Atom feed of new verdicts)

## Install the hook

npm i -g vet-skills && vet-skills hook install claude-code

## Contact

sales@killerskills.ai · security@killerskills.ai · Operated by Cyligence, LLC.