Every entry says whether it is clean.
Skill lists exist. What none of them tell you is whether a skill is safe to install. Here, every skill carries a verdict that was produced by running the scanner — the date and engine version are on the card, and the script that generates them is in the repository. One entry is a registry rather than a skill file; it carries no verdict and says why, because that is not the same thing as a missing one.
21 skills indexed · Verdicts last refreshed: 2026-07-31
What the verdicts mean
| pass | No rule matched. That is not a guarantee — read the limits before you treat it as one. |
| review | It reaches further than it claims to. Worth a deliberate look rather than a skim. |
| block | Something certain and serious was found. Do not install it without reading the finding. |
| unscanned | Listed but not yet verified. Shown honestly rather than quietly assumed clean. |
| not scannable | There is no skill file to read — the entry is a service or a registry. It says on its card why, because "no verdict" and "nothing to scan" are not the same thing. |
This index is young, and says so
It starts with the skills I can scan myself. It grows by pull request: add an entry, and continuous integration runs AIRLOCK over the skill before it can be merged. An index that lists everything and verifies nothing would be worse than no index at all.
Fork and add an entry
One object in content/catalog.json: name, source, link, what it does. Leave scan as null.
Open a pull request
CI fetches the skill, runs AIRLOCK over it, and writes the verdict into your entry. You do not fill that part in.
A human reads it
A verdict of block does not automatically reject the entry — sometimes a security tool legitimately trips its own rules. It does mean somebody explains why in the pull request.