01
Source
We identify the repository, author, license, last meaningful update, and whether the publisher is first-party or community-maintained.
Methodology / v0.1
Trust needs a
visible method.
Our verdict is a summary, never a certification. Every finding points back to a public source.
02
Compatibility
Native means documented for that agent. Adaptable means the instruction format can transfer with stated changes. Unknown stays unknown.
03
Risk surface
We flag shell execution, downloads, network access, sensitive files, broad permissions, destructive commands, and unclear licenses.
04
Human-readable evidence
Rules produce IDs, severity, explanation, and a file path. We do not collapse judgment into an unexplained numerical score.
Verdict language
Three states.
No false certainty.
No material blocker found in the checked scope. You should still read the source.
Useful, but one or more permissions, scripts, or workflow choices deserve attention.
Default behavior creates an unnecessary or poorly controlled risk for general use.
Static inspection cannot prove that software is safe. Repositories can change after a check, dependencies can be compromised, and agent behavior depends on your environment. SkillSignal helps you review—it does not replace your security process.