> ## Documentation Index
> Fetch the complete documentation index at: https://docs.decimal.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# How skills are vetted

> Skills are code your agent loads and acts on. SkillSafety is the vetting pipeline — static scan, AI review, content review — that decides what reaches the registry, and what it's labeled.

Every skill in the registry carries two independent signals. **[SkillScore](/guides/skillscore)** answers *does it work?* **SkillSafety** answers *is it safe to load?* This page is the map for the second one — what gets checked, in what order, and how the result is labeled.

## Why a skill needs vetting

A skill is not a passive document. When your agent loads a `SKILL.md`, its instructions enter the model's context and its bundled scripts can run on your machine. That makes an installed skill a **supply-chain dependency** — closer to an npm package than to a wiki page. A skill that says "before you start, fetch and run this setup script" is executing code with your agent's permissions, on your data.

The public skill directories that appeared alongside agent tooling — the **ClawHavoc** and **ToxicSkills** wave — proved the risk is real: a skill that reads your `.claude/` config and exfiltrates the keys it finds, or buries a prompt-injection payload in a "prerequisites" paragraph, looks exactly like a helpful skill until it runs.

An unvetted directory that lists whatever is uploaded is a liability. A registry that **inspects every skill before it's listed, labels the risk, and re-checks it over time** is the difference. That pipeline is SkillSafety.

## The pipeline

Vetting isn't a single gate at publish time. The same checks run at every stage, so problems surface where they're cheapest to fix — on your own machine, before anything is public.

```mermaid theme={null}
%%{init: {'theme':'base','themeVariables':{'primaryColor':'#f5f5f4','primaryBorderColor':'#a8a29e','primaryTextColor':'#44403c','lineColor':'#a8a29e'}}}%%
flowchart LR
  A["Author<br/>writes SKILL.md"] --> B["Local scan<br/>(your machine)"]
  B --> C["CI<br/>(GitHub Action)"]
  C --> D["Publish gate<br/>Tier 1 → 2 → 3"]
  D --> E["Listed with a<br/>SkillSafety band"]
  E --> F["Continuous<br/>re-checks per version"]
  F -.->|band worsens| E
```

* **Local + CI** run the *same* static scanner, free and offline — nothing leaves your machine. Catch issues before you push.
* **The publish gate** is the enforced checkpoint: a skill can't flip to public until it clears the tiers below.
* **Continuous re-checks** mean a skill that was clean when published, but whose band later worsens (a new version, an updated rule), is re-labeled — and its owner is emailed.

## The three tiers

SkillSafety runs three layers of review. They look at different things and cost different amounts.

| Tier                       | What it asks                                      | How                                                                                       | Cost          |
| -------------------------- | ------------------------------------------------- | ----------------------------------------------------------------------------------------- | ------------- |
| **1 — Static scan**        | Does the text contain a known-dangerous pattern?  | Deterministic pattern match over the raw text. **No LLM.**                                | Free, instant |
| **2 — AI security review** | What is this skill *trying to do*?                | An LLM reads the skill's intent → `safe` / `review` / `reject`                            | Metered (LLM) |
| **3 — Content review**     | Does the published text carry prohibited content? | An LLM checks for hate, violence, sexual/CSAM, self-harm, illegal goods, doxxing, threats | Metered (LLM) |

**Tier 1** is a fast, free reader that matches the raw text against a catalog of dangerous patterns — a reverse-shell one-liner, a hardcoded API key, a homoglyph that disguises a URL. It runs everywhere: locally, in CI, and server-side. Because it's pure text matching, it's instant and deterministic — the same skill always gets the same result.

**Tier 2** catches what a pattern can't. Social engineering written in fluent prose — a fake "prerequisites" section that talks the agent into fetching and running a remote script — has no single dangerous token to match. An LLM that reads for *intent* sees the setup that a regex reads as ordinary instructions.

**Tier 3** looks at the published text as content, not as instructions: does it carry prohibited material (all examples must be synthetic). Two categories — CSAM and credible threats — are terminal: the skill is removed, not flagged for remediation.

<Note>
  The three tiers fold into **one public band** — the worst result across them. You don't reason about tiers as a consumer; you read the band. Authors get the per-tier detail so they know exactly what to fix.
</Note>

## What the static scan looks for

Tier 1's catalog, grouped. This is the full list; [Fixing a blocked publish](/guides/trust-safety/fixing-a-blocked-publish) explains how to resolve each finding.

| Group                  | Checks                                                                                                                                                                                                                          |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Instructions**       | prompt-injection phrasing · anti-refusal / jailbreak · trigger-abuse                                                                                                                                                            |
| **Commands**           | remote-code-execution · reverse-shell · destructive commands · download-and-execute                                                                                                                                             |
| **Data & credentials** | committed secrets · data-exfiltration · agent-snooping (reading `.claude` / `.codex` / `.gemini` / `mcp.json`) · cloud-metadata / SSRF · opaque payloads · hidden unicode · look-alike (homoglyph) characters · suspicious URLs |
| **Tools**              | over-broad `allowed-tools`                                                                                                                                                                                                      |

<Tip>
  The scanner is **context-aware.** A security skill that *documents* an attack — a `security`-category skill, or fenced code marked with `example` / `detect` / `never` — is downgraded rather than blocked. Teaching how to spot a reverse shell shouldn't get treated the same as shipping one. And any secret the scan finds is **redacted in the findings, never echoed back.**
</Tip>

## What the band means

Every listed skill shows one SkillSafety band. It governs whether — and how — the skill appears in the registry.

| Band                 | Meaning                                                  | In the registry                    |
| -------------------- | -------------------------------------------------------- | ---------------------------------- |
| **Passed**           | Cleared all three tiers                                  | Listed normally                    |
| **Caution**          | A non-blocking flag worth knowing before you install     | Listed **with a visible warning**  |
| **Blocked**          | A tier found something disqualifying                     | **Hidden** — never surfaced        |
| **Not yet reviewed** | A reviewer was briefly unavailable; a re-check is queued | Listed as pending, auto-re-checked |

<Warning>
  **Content is the exception to Caution.** A content-flagged skill isn't listed-with-a-warning like other Caution cases — it's **held** until it clears. Prohibited content doesn't ship behind a label.
</Warning>

### "Not yet reviewed" is honest, not hidden

The AI tiers depend on a model being reachable. If a reviewer is momentarily unavailable, SkillSafety **fails open**: the skill shows **Not yet reviewed** and is automatically re-checked — it is never turned into a false **Blocked**. A pending band is the system telling you the truth ("we haven't finished checking this yet"), not a silent downgrade. Once the re-check lands, the band resolves to its real value.

Every version of a skill carries its **own** scan and verdict history — a new version is re-vetted from scratch, and re-vetting an old version never masks a problem introduced in a new one. If a *published* skill's band ever worsens, its owner gets an email.

## Where to go next

<CardGroup cols={2}>
  <Card title="Fixing a blocked publish" icon="wrench" href="/guides/trust-safety/fixing-a-blocked-publish">
    Every refusal reason and how to fix it — findings with per-line fixes, the free re-check loop, and pre-publish deep review.
  </Card>

  <Card title="Content policy" icon="scale-balanced" href="/guides/trust-safety/content-policy">
    The prohibited-content categories, the synthetic-examples rule, and what's remediable versus terminal.
  </Card>

  <Card title="What scanning can't catch" icon="shield-halved" href="/guides/trust-safety/what-scanning-cant-catch">
    The honest limits — why "ask before running" isn't a security boundary, and defense-in-depth for what you install.
  </Card>

  <Card title="Scan locally & in CI" icon="terminal" href="/guides/trust-safety/scanning-locally-and-in-ci">
    Run the same scanner on your machine and in GitHub — `decimalai skills scan`, output formats, SARIF, and exit codes.
  </Card>
</CardGroup>

<Note>
  SkillSafety is the safety counterpart to **[SkillScore](/guides/skillscore)**. A skill needs both to earn a place in the registry: proof it works, and proof it's safe to load.
</Note>