The order the gates run
Publish runs four gates in sequence. The first one that fails is the reason you see — fix it, re-publish, and the next gate runs.The publish gate itself is always free — you never spend quota to attempt a publish, no matter how many times you retry.
Reason → meaning → fix
safety_blocked — Tier-1 static scan
Tier-1 is pure text analysis: regex and structural checks, no LLM, run instantly and free on every publish. It groups its checks into four families.
The findings modal is built to be actioned line by line. For each critical finding you get:
- Check — which rule fired (e.g.
data-exfiltration) - Line — where in the body it matched
- Evidence — the offending snippet, with any secret redacted — the scanner never echoes a credential back to you
- Fix — the concrete change that clears it
intent_rejected — Tier-2 AI security review
Where Tier-1 reads patterns, Tier-2 reads intent. An LLM judge evaluates what the skill is actually trying to make an agent do and returns safe / review / reject. A reject becomes intent_rejected.
This tier exists to catch what a regex structurally can’t: fluent, well-written social engineering. The classic case is a skill with a friendly “Prerequisites” section that instructs the agent to curl a URL and pipe it to a shell before doing anything useful — every individual line looks benign, but the intent is to fetch-and-run attacker code.
To fix: read the judge’s rationale, cut the instruction that steers the agent toward the unsafe action, and re-publish. If you believe the skill is legitimate security tooling, apply the same example / detect / never markers and security-category framing that Tier-1 respects — the judge weighs framing too.
content_blocked / content_removed / content_unverified — Tier-3 content safety
Tier-3 asks a different question from the first two tiers: not is this skill dangerous to run, but does the published text itself carry prohibited content. An LLM reviews the body against these categories:
- Hate
- Graphic violence
- Sexual content / CSAM
- Self-harm
- Illegal goods
- Doxxing / PII
- Credible threats
- Examples must be synthetic. If your skill needs to show a sample email, sample PII, or sample abusive message, fabricate it. Real personal data trips the doxxing/PII check.
- Two categories are terminal. CSAM and credible threats produce
content_removed— the skill is taken down and cannot be re-published. Every other category is remediable: edit the text and re-publish.
content_unverified is not a violation at all — it’s the fail-open state when a reviewer was momentarily unavailable. The skill shows Not yet reviewed and is re-checked automatically. You never get a false block from a reviewer outage.
The remediation loop
Every refusal returns structured findings, each with its own fix. The loop is short:1
Fix the body
Apply the per-finding fix from the modal — remove the secret, rewrite the manipulative step, replace real PII with synthetic, add
example / detect / never markers to legitimate security content.2
Re-run checks (free, Tier-1 only)
The Re-run checks button re-runs the Tier-1 static scan on any skill you own — no publish required, no quota spent. Use it to confirm you cleared a
safety_blocked finding before you attempt the full publish.3
Re-publish (re-runs all three gates)
Publishing re-runs Tier-1, Tier-2, and Tier-3 in order. The publish attempt is always free, so there’s no cost to iterating.
Re-run checks covers Tier-1 only — the deterministic scan is free to run as often as you like. The LLM tiers (Tier-2 and Tier-3) run at publish time, or on demand via Deep review below.
Deep review — clear the LLM tiers before your launch
The publish gate runs Tier-2 and Tier-3 at the moment you publish. If you’d rather not discover anintent_rejected or content_blocked during your launch, run those LLM tiers ahead of time against a private draft with Deep review. It runs the same Tier-2 + Tier-3 checks on an unpublished skill so you can fix findings on your own schedule.
Deep review is metered. Each plan gets a monthly quota:
The quota applies only to Deep review — the on-demand LLM run against a private draft. The publish gate itself is always free, and so is the Tier-1 Re-run checks button. Deep review buys you the LLM verdict before the launch moment; it doesn’t gate publishing.
Catch it locally, before the server ever sees it
The same scanner that powers Tier-1 runs on your machine — free, no API key, and nothing leaves your laptop. Run it in your editor or wire it into CI so asafety_blocked never reaches a publish attempt.
--format text | json | github | sarif. Blocked findings exit 1, so the scan fails your build. sarif uploads straight to GitHub code scanning.
When a live skill goes bad
Review doesn’t stop at publish. Every version carries its own scan and verdict history, and a real adverse verdict on an already-published skill de-lists it — the skill drops out of the registry and the owner gets an email that the band worsened. If you own a published skill, watch for that mail; it means a re-check found something the original publish didn’t.
Related
Community Registry
Publishing, forking, and the benchmark-presence gate that runs before SkillSafety.
SkillScore
The effectiveness band that sits beside SkillSafety on every skill.
skillevaluation
The package that ships the
scan command and the A/B benchmark.