The threat is real, the solution is sound, and the paying customer base might not exist yet.
Let me tell you what's actually happening in agent plugin ecosystems right now, because if you haven't been watching, it's kind of alarming.
LangChain Hub, AutoGPT plugins, AgentVerse, Flowise's marketplace — these are all growing fast, accepting community contributions, and doing basically no automated security review that's specific to agent threats. A malicious skill doesn't need a CVE. It doesn't need to exploit a buffer overflow or trigger an existing signature. It just needs to be a valid LangChain Tool that reads `os.environ` and sends it to an attacker's endpoint on first invocation. That's it. One function. No existing SAST tool catches it because no existing SAST tool has a rule that says "LLM tool call + outbound HTTP to non-whitelisted domain = suspicious."
That's the unfair insight this idea is built on, and it's a real one.
The r/webdev thread cited as proof of demand has 2,931 upvotes and the top comments are specifically about agents making unexpected network calls and dependencies the developer didn't write. That's not manufactured demand. That's senior developers publicly admitting they're scared of something they can't fully audit.
The competitive gap is also real. Semgrep is a fantastic tool but it's a general-purpose pattern matcher — you bring the rules, it finds the patterns. It has no native concept of "this is a LangChain tool callback and it's doing something a LangChain tool callback shouldn't do." Snyk understands CVEs in dependency trees. Socket.dev does behavioral analysis on npm packages and it's genuinely impressive, but its threat model is npm packages, not agent skills with manifest-defined permissions and LLM-mediated invocations.
The differentiation here isn't marginal. It's categorical. You'd be building a threat taxonomy that simply doesn't exist yet: credential harvesting via tool calls, unauthorized wallet operations, prompt injection via skill responses, arbitrary egress from sandboxed agent execution. No one has a labeled dataset of this stuff because no one has been scanning for it systematically.
The moat story is also compelling if you believe it. Every skill you scan goes into a corpus. Benign skills, flagged skills, confirmed malicious ones. Over time that dataset lets you train classifiers that catch semantically obfuscated exfiltration — the kind where the threat is in what the code is trying to do, not a literal keyword match. A late entrant can copy your rules but they can't copy your dataset. That's a real compounding advantage.
And the GitHub App distribution model is smart. Maintainers are already in GitHub. They're already reviewing PRs. A check that posts pass/warn/fail with line-level annotations fits exactly where they're already looking. Installation friction is low. Uninstallation friction is high — you have to actively decide to remove a security layer, which most maintainers won't do once they've seen it catch something real.
Let's talk about the fatal flaw, because it's genuinely fatal if you're not honest with yourself about it.
The addressable paying customer base today is probably 200 to 500 serious OSS agent maintainers worldwide. At $49/month with 100% conversion — which will never happen — that's roughly $300K ARR. That cannot sustain a company. It can barely sustain a founder if they're living cheaply.
The market size estimates in the idea are optimistic in a way that feels like motivated reasoning. "50,000 active OSS AI agent repos on GitHub" is probably true. "5,000 with serious contributor activity" is a stretch. "500 with genuine plugin/skill marketplace needs" is probably close to accurate, and that's the number that matters for your business. The path to the $6M-$18M ARR figure requires most of those 5,000 repos to have a security budget, which they don't. Open source maintainers famously don't pay for tools. The ones who do pay are usually backed by companies, and those companies are your actual target — which is a completely different sales motion than a GitHub App install.
The enterprise pivot is the only real path to revenue. Internal platform teams at companies running private agent ecosystems, marketplace operators with actual security budgets. But those deals take 3-6 months to close, require procurement, legal, and infosec sign-off, and you need the OSS credibility first to get in the door. So you're looking at 6 months of OSS distribution work before you can even start having enterprise conversations, then another 3-6 months of sales cycle. That's a year before meaningful revenue, minimum.
I don't know how to feel about that timeline. It's not impossible, but it requires genuine patience and a very specific kind of founder discipline — building distribution before building revenue, which is counterintuitive and psychologically hard.
The sandboxed execution piece deserves its own honest discussion, because I think the 6-8 week solo dev timeline is underselling how hard this is.
gVisor and Firecracker are not weekend projects. Running arbitrary third-party code safely in a sandbox is one of the hardest problems in systems engineering. If your sandbox is too permissive, you miss the threats you're supposed to catch. If it's too restrictive, you break legitimate skills and get false positives that destroy maintainer trust in the first two weeks. If it's too expensive, your unit economics fall apart at scale.
The suggestion to stub sandboxing with network interception only for the MVP is actually the right call — but you need to be honest with users that you're not running full dynamic execution yet. If you overpromise on the dynamic analysis and a malicious skill slips through because your stub missed something your full sandbox would have caught, you lose the maintainer's trust permanently. Early trust is the entire business in this space.
Here's the scenario I find genuinely scary: LangChain Inc. adds a security checklist to their contribution guidelines. GitHub ships agent-aware CodeQL rules as part of GitHub Advanced Security. Microsoft has every incentive to do this — Copilot trust and safety is a major enterprise concern — and they have the distribution to make it a free feature overnight.
Neither of these is certain. But both are plausible within 18 months, and Socket.dev's $40M Series B gives them the runway to add an agent skills vertical if they decide it's worth pursuing. The activation energy for Socket to do this is genuinely low. They already have the behavioral analysis infrastructure, the GitHub App distribution, and a paying developer customer base.
You're not building in a vacuum. You're in a race, and some of your competitors don't know they're racing yet.
Here's my honest take: this is worth building, but not as the idea is currently scoped.
The MVP should be a free GitHub App with a generous public repo tier, full stop. No pricing conversation for the first 3 months. Get installed on LangChain, CrewAI, Flowise, and AutoGPT. Build the threat taxonomy in public. Write a blog post every time you find something real — "we scanned 10,000 community skills and here's what we found" is the kind of content that gets attention from security researchers, from enterprise platform teams, and from journalists who cover AI safety.
That public install base and that public threat dataset is your entire sales pitch to the first enterprise customer. Without it, you're asking a corporate infosec team to trust a scanner with no track record.
On the false positive problem: launch conservatively. Only flag patterns you're 95%+ confident about. A tool that misses some threats is survivable. A tool that cries wolf on every PR gets uninstalled in week two.
And on the build timeline: be ruthless about scoping the MVP down to static analysis plus lightweight network interception. Get that installed and working. Treat full sandboxed execution as a v2 feature that you build once you have real customer feedback on what threats actually matter in the wild.
The person who should build this is someone who genuinely understands both agent framework internals and security tooling, because building the threat taxonomy is the hard part — not the infrastructure, not the GitHub App integration. If you're a developer who's been deep in LangChain or AutoGen and has a security background, this is a problem you're uniquely positioned to solve. If you're a generalist looking for a market opportunity, you'll struggle to build the thing that actually matters, which is the detection logic.
The market timing is early. That's both the risk and the reason there's still a window. If you wait until agent marketplaces are mature enough to have security budgets, someone else will already own this space. If you build now, you're betting that the market catches up to you within 18 months. That's not a crazy bet. But it is a bet, and you should go in with your eyes open.