Agent Skill Auditor (SaaS)

The Problem

Maintainers of open-source AI agent repos and marketplaces routinely accept community-contributed "skills" or plugins that can exfiltrate secrets, steal crypto, or perform other malicious actions. This happens often as projects scale and accept random contributions; current general-purpose SAST/SCA tools miss agent-specific malicious patterns (e.g., arbitrary network calls, wallet-access code, credential harvesting) and projects lack an automated review pipeline tailored to agent skills.

Why now: Rapid rise of AI agent ecosystems and plugin marketplaces has created a new attack surface; existing SAST/SCA tools are not tuned for agent behaviors and AI-driven code, so specialized tooling is now needed.

The Solution

A cloud SaaS that performs automated multi-layer audits of agent skills: static code analysis tuned for agent APIs, dynamic sandboxed execution to surface network/callout behaviors, dependency/supply-chain checks, manifest/permission analysis, provenance & signing checks, and a risk score + human-review escalation. The MVP is a web UI + API where you upload a skill or point a GitHub repo and get a detailed report (dangerous network IO, crypto ops, privilege escalation) and remediation suggestions.

Built for: Maintainers of AI-agent platforms, open-source repo owners, marketplaces that publish agent skills, and platform integrators embedding agent plugins.

Business model: subscription

Market Overview

Agent Skill Auditor (SaaS) targets a medium-sized market ($100M–$1B TAM). Existing solutions are incomplete or outdated — there's clear room for a better product.