Review process
Every imported repository and every submission enters quarantine. Approval applies to an exact commit and archive hash — not permanently to a repository. We show what ran, what it found, and what it cannot tell you.
Candidates in catalog
1,004
Approved commits
0
Scan reports published
1
Every scan we run is published in full — commit and archive hashes, tool and ruleset versions, signature dates, findings, and what each check did not cover.
| Check | Implementation | Boundary |
|---|---|---|
| Archive validation | Bounded archive parser | Rejects traversal, links, special files, and size or entry-limit violations |
| Prompt injection and suspicious source | Custom source rules | Heuristic inspection of code, README text, and instructions |
| Exposed secrets | Gitleaks | Redacted findings; trusted configuration prevents repository allow-comments from suppressing checks |
| Suspicious code | Semgrep | A small checked-in Python/JavaScript/TypeScript rule set, not a comprehensive code audit |
| Skill instructions | Cisco Skill Scanner | Static analysis with a strict policy for SKILL.md; cloud analyzers disabled |
| Malware | ClamAV | Archive scan with signatures no older than 24 hours for admission |
| Known dependency vulnerabilities | OSV API | Supported pinned dependencies only; incomplete resolution blocks admission |
| Techandria Audits | Instruction, Agent Tool and Supply Chain audits | Built in-house and run offline; a fail blocks admission and every warning must be acknowledged by name |
| Runtime behavior | Isolated Python or Node smoke test | Reviewer-selected entrypoint, no network, no installed dependencies |
| Admission | Operator review and build gate | Requires complete, current evidence and a matching human approval |
Three audits we built ourselves, modeled on the threats found in real malicious agent skills and MCP servers. They run inside the same offline sandbox as everything else. When a rule cannot tell a real attack from a mention of one (a security skill quoting the phrase it warns about), a short excerpt of that public repository text is sent to Claude for a second opinion. The second opinion can make a finding more serious, or soften it to a warning. It can never pass a project by itself. Each audit ends in Pass, Warn or Fail. A failure blocks a project from being reviewed, and a reviewer has to acknowledge every warning by name.
SKILL.md, AGENTS.md, CLAUDE.md, agent rules, READMEs and every bundled document an agent may read.
Prompt injection, instructions hidden in invisible Unicode or HTML comments, fake "prerequisites" that download and run software, instructions fetched from the internet at runtime, attempts to rewrite an agent's memory or config, requests to skip permission prompts, and credential theft.
The tools, prompts and parameters an MCP server or plugin declares, extracted from source without running it.
Tool poisoning (instructions buried in tool descriptions), tools that try to change how other tools behave, dangerous combinations such as reading untrusted content and private data and then sending data out, destructive tools with no confirmation, and tool definitions that can change after review.
Manifests, lockfiles, install scripts, bundled code and binaries, plus the repository's own history.
Install scripts that download or decode code, typosquatted dependency names, dependencies from outside a registry, known-malicious and known-vulnerable packages, obfuscated code, reverse shells, code that reads credentials and sends them out, opaque binaries, and archived or brand-new repositories.
Scanner containers run inside a dedicated virtual machine with no network, host mounts, forwarded credentials, or root privileges. They use a read-only system filesystem, disposable temporary storage, and resource and time limits. Only dependency identifiers leave the host, to the OSV advisory API.
They cannot prove software is safe. They can miss attacks and flag benign examples. Runtime checks currently support only Python standard-library smoke tests. A passing scan describes one commit at one moment — not the repository's future, its maintainers, or its dependencies. “Not reviewed” means discovery metadata only. It is not permission or a recommendation to execute the code.
Submit a repository and it enters quarantine with everything else.
Submit a project