Skip to content
LoopSkill

Security & audit

Three layers of review.
Audit status on every skill.

A skill is a piece of software your AI agent will execute on your machine. LoopSkill treats it that way. Below is what happens between a creator publishing a skill and an install landing on your laptop — and what does not happen. Each skill's page shows its own audit status; some say "Not yet audited".

01

Allowlist linter

Every published skill ships with a positive-allowlist manifest. The linter blocks merge if a skill reads, writes, or sends anything not on the list — credentials, environment variables, network destinations, file paths. We don't try to enumerate "bad" patterns; we explicitly enumerate the "good" ones.

  • → Publisher ed25519 signature over the tarball checked by the API at upload; install returns a sha256 checksum you verify against the downloaded bytes
  • → Layered scan before catalog entry: security + discipline + quality gates must all pass
  • → Two-stage trust: anonymous PRs land as drafts, require human reviewer approval before promotion
  • → Failed installs are filed as feedback issues and fed back through the pipeline → patches shipped within the same release cycle
  • → Versioned forever, content-addressed (sha256) — pin an exact version via the `version` query param on GET /api/skills/install, or the loopskill_install MCP tool's version argument.
02

Sandbox runner

Before a skill goes live, it runs in an ephemeral container with no outbound network except the explicitly allowlisted domains. The runner records every syscall, every fetch, every disk write, and replays it for a human reviewer. Skills that touch surfaces they didn't declare are rejected.

proof: loopskill-api/app/security_scan.py

03

Creator track record

A publisher's upload carries an Ed25519 signature over the tarball's SHA-256, and the API verifies it before anything is stored. Every install returns the stored tarball's SHA-256 (checksum_sha256) next to an expiring download URL, so an installer can detect a replaced or corrupted tarball by comparing hashes. The signature itself is not served at install and is not re-verified by the installer.

proof: GET /api/skills/install returns checksum_sha256 — compare it with the SHA-256 of the downloaded bytes. Upload-time check: loopskill-api/app/publisher_routes.py (_verify_ed25519).

Guarantees we make

MIT skills, MPL-2.0 platform

The free skills catalog is MIT; the registry, runner and this site are MPL-2.0. You can read, fork, audit, or replace anything you install.

Telemetry: minimal, and you can opt out

When you install a skill we record an install event (skill, version, time, ref/utm tag, IP address, and your API key if you used one) to count installs. Installer clients send one anonymous daily heartbeat (a random salt + the date) unless you set RECIPES_TELEMETRY=off. Skills run on your machine; we do not see what they do there. Full details: /privacy.

Reproducible tarballs

Mtime/uid/gid stripped. Two packs of the same source produce byte-identical archives.

Public review history

Changes to the free skills catalog are reviewed in public, in the GitHub issues and pull requests of wisechef-ai/awesome-agent-recipes (the catalog repo still carries its name from before the LoopSkill rename).

Verify a skill yourself

curl "https://app.loopskill.io/api/skills/install?slug=super-memory"

The install response includes checksum_sha256 and a short-lived tarball_url. Download the tarball, compute its SHA-256 yourself (sha256sum) and compare. This catches a corrupted or swapped download. It does not protect against a compromised server, because the same server sends both: the publisher's signature is checked when a skill is published, and it is not included in this response.

This page last updated: · Source on GitHub · MPL-2.0 licensed