// Reference
Skill safety check
ArtifactBridge checks every version of a Skill before it can reach an agent. The check looks for patterns that can harm the people who install the Skill: hidden text, secrets, commands that download and run code, and similar risks. It reports the line and the rule. It never stores or shows the matched text.
Important
No issues found is not proof of safety. The check finds known patterns. It does not understand what a Skill is meant to do. Read a Skill before you trust it.
Results
Each check gives one result for the exact version that is checked.
| Result | Meaning |
|---|---|
| High risk | At least one critical finding, for example a command that downloads and runs code, or a secret. |
| Caution | At least one high or medium finding, for example an instruction to ignore earlier instructions, or an unpinned package runner. |
| No issues found | Only low or informational findings, or none. |
| Not fully checked | A file is larger than the size or line-length limit, contains bytes that are not text, or the whole Skill is larger than the limit. Parts were not checked. |
A Skill that is High risk or Not fully checked needs a person to give a reason before the version can be used. The same rules apply to every file of the Skill and to the Skill as a whole.
What it checks
| Family | Examples |
|---|---|
| Hidden text | Unicode Tag characters (critical), text direction controls (high), invisible characters inside words, and instructions inside HTML comments. |
| Secrets | Private keys, JSON Web Tokens, and API tokens in common formats (critical). |
| Download and run | Remote content sent into a shell or interpreter, or downloaded and then run (critical). Unpinned package runners such as npx -y, uvx, pnpm dlx, bunx and pipx run (medium). |
| Runs on load | !`command` lines and blocks, frontmatter hooks, and frontmatter allowed-tools that allow any shell command (critical) or network tools (medium). |
| Credential access | Reads of SSH keys, cloud credentials, .netrc, .env, the keychain or the full environment. |
| Persistence | Writes to agent instruction files such as CLAUDE.md and AGENTS.md, shell start-up files, Git hooks and scheduled tasks. |
| Instruction override | Phrases that tell an agent to ignore earlier instructions. |
| Decision tools | Names of ArtifactBridge tools that accept, publish, grant or revoke. |
| Outside links | Links to a host that is not on the trusted list (low). |
| Across files | A download in one file of a Skill and a run step in another file of the same Skill (critical). |
Trusted hosts
Links to these hosts are informational only: app.artifactbridge.com, github.com, *.github.com, raw.githubusercontent.com and linear.app. A trusted host never lowers any other finding. A command that downloads from a trusted host and runs the result is still High risk. The list is built in; a workspace cannot change it.
What it does not check
- What the Skill is meant to do. The check does not read intent and does not use an AI model.
- Look-alike characters, encoded content such as base64, and binary files.
- Combinations across files other than download in one file and run in another.
- Code examples. A Skill that quotes an attack, for example a security how-to, gets the same result as one that runs it.
- Reputation or results from outside scanners.
Where results show
- Proposals and saves: the review card shows the result for the exact text that Accept, Apply to current or a partial redline would write.
- Skill documents: the document title shows the result, and the Safety check section in the side panel shows the check date. View findings shows the checked text with each flagged line and the rule it breaks.
- Skill Hub: each Skill shows its result. A result counts only the files you can open.
- Desktop app and CLI: each Skill in the Skills list shows its result. Select the result to see who gave a reason, when the check ran, and a link to the findings in the web app.
artifactbridge skills list --jsonincludes the result. - Agents: tool results include the check and, when a reason is needed, a link for a person to open.
- Inbox: held updates, worse results after a rules update, and Skills that need attention.
Results never name or count files that you cannot open.
Give a reason
When a version needs a reason, a person types it in the ArtifactBridge web app before the version is accepted, saved or registered. The reason is recorded with the person's name. Only a person in the web app can give a reason; an agent, the CLI and Slack cannot. Slack shows a Review in ArtifactBridge button instead.
A reason applies to that exact file version and rules version in that document only. Any change to the file needs a new reason.
Held updates
When a Skill file changes and the new version needs a reason, people who install the Skill keep the last approved version. The update is held. People who can open every file of the Skill get an Inbox item. One of them can choose Allow update and give a reason. A clean newer version, or a return to the approved version, releases the hold without a reason.
Checks in every workspace
Skill checks apply in every workspace. Before you accept, save or register a Skill version, its check must finish. A High risk or Not fully checked version needs a person's reason. A reason cannot replace a pending or failed check.
Skills installed before checks existed keep their delivered versions. ArtifactBridge checks them and gives each person an Inbox item for the High risk or Not fully checked Skills they can open. Later changes follow the same check and reason requirements as new Skills.
When the rules change later, ArtifactBridge checks Skills again. A worse result creates an Inbox item but does not stop an approved version.