I built an AI-agent skill to audit supply-chain attack exposure
Dependabot already does this without the AI agent overhead.

Security-scanned SKILL.md marketplace when GitHub repos have no vetting.
AI coding agent users (Claude Code, Cursor, Codex CLI)
GitHub Skills · Cursor Extensions · Anthropic Skills
What it is: a curated marketplace for SKILL.md skills. SKILL.md is the folder-plus-instructions format Anthropic shipped for teaching AI coding agents (Claude Code, Cursor, Codex CLI, Gemini CLI, and others) new capabilities. Creators publish skills, users install them into their agent. Every listing goes through an automated security scan before going live.
Two things I've tried to do that felt missing from the ecosystem:
1. Curation with security. Running someone else's code on your machine without review is a real risk, especially given the ToxicSkills and ClawHavoc research that came out earlier this year (36% of sampled skills had prompt injection vectors). Every skill on Agensi runs through an automated scan checking permission boundaries, outbound network requests, dependency red flags, and common malware patterns. It's not perfect and doesn't replace reading the code yourself, but it filters the obvious bad stuff.
2. Creator monetization. Two paths, creator picks whichever fits the skill. Direct sales: set a price, buyer pays once, creator keeps 80% minus a $0.50 per-sale fee. MCP subscription pool: 70% of net MCP subscription revenue distributed monthly based on which skills paying users actually pulled in via MCP. The idea is that time spent encoding your workflow knowledge as a SKILL.md shouldn't just earn you GitHub stars.
There's also an MCP server that makes skill discovery agent native. Four tools: search_skills, get_skill, submit_skill_request, get_skill_requests. Your agent can search the catalog and pull in a skill mid-task instead of you browsing the site. If the skill is not on the marketplace, the agent can add a skill request that pings every creator on the platform. Subscription is $9/month with a 3-day trial.
Honest state of things:
- 40 creators, 200+ skills listed - 66 articles in the Learn section, ~7k active users over the past 28 days - MCP subscription launched last week. 1 paying subscriber so far (yearly), 1 trialist who cancelled before converting. Too early to say anything about conversion. - Pre-seed discussions with VC’s ongoing - GMV month 1 of ~200$
Things I'd genuinely want feedback on:
- Creator split. Direct 80/20 and MCP 70/30. I picked numbers that felt defensible after running the math on infrastructure and payment costs. Open to the argument that either should skew further toward creators.
- Security scan depth. The current scan is automated and covers the basics. Whether to add creator identity verification, manual review queues, or public scan reports per skill is an open question for me.
- Moat. Anthropic, Cursor, and others could launch first-party skill stores whenever they want. My thesis is that a curated cross-agent marketplace is defensible because first-party stores are always vendor-locked. I would like to hear counterarguments.
- Skills you've wished existed but couldn't find. Open to hearing what's missing from the catalog.
Browse is free, no signup needed: https://agensi.io
I'll be in the comments.
Dependabot already does this without the AI agent overhead.
One command installs AI skills across Cursor, Claude Code, and 15 other agents.
Agent skills marketplace, but it's a glorified gumroad for prompts.
Automates Astral's security framework into an agent skill that produces HTML reports.
Docker sandbox execution catches runtime threats static analysis alone misses.
Security scanning catches data exfiltration before skills go live.