Five gates before any submission publishes

The uploaded package is unpacked in isolation. Contents are checked file by file. Hidden files, unsafe paths, and path-traversal tricks are rejected on the spot.

Skill packages are documents and templates, not programs. Only markdown and plain-text files are accepted; executables, compiled binaries, and scripts are rejected automatically, including binaries disguised with a text file extension.

Every file is scanned for red flags: pipe-to-shell downloads, reverse-shell patterns, embedded credentials, large encoded payloads, obfuscated commands, and prompt-injection patterns aimed at AI assistants. Hostile patterns reject outright; borderline ones are carried into the reviews below.

Two models read the package end to end, and they never see each other's verdict. One reads it as a hostile document: could following these instructions leak a borrower's data, reach for a credential, call out to somewhere the lender did not choose, or quietly redirect the assistant running it. The other checks whether the skill is what it says it is, whether the lending claims are stated as facts to verify rather than settled truth, and whether anyone's real deal data is sitting in it. Both score it. A single critical finding stops the package no matter how well it scores everywhere else.

A second model, which never sees the security report, checks the package is what its listing claims, that no rate, LTV limit or licensing rule is stated as settled fact, that nobody else’s real deal data is inside, that the legal disclaimer is present, and that it is not a duplicate of something already published. It scores the package and names what would have to change. Nothing here is hidden from you: every skill page shows its own screening record, including which gates it cleared and how.