Akula

Skills provenby evidence,not by stars.

Akula scans every SKILL.md for attacks, then measures whether it actually improves your agent, model by model.

Check a skillBrowse catalog
skills scanned
31
files read
585
detection rules
22

Security

Static scan: injections,
secrets, hidden payloads.

Effect

Paired runs: measured
delta for each model.

Catalog includes skills fromanthropicspbakausnextlevelbuilderobra

A star is
not a result.

In SWE-Skills-Bench, 39 of 49 skills gave no gain in pass rate.

Install nothing
on faith.

Snyk reviewed 3,984 public skills and confirmed 76 with malicious payloads.

Measure the
difference.

The same tasks, with the skill and without it. Only deterministic checks decide who passed.

Model A
Model B
Model C
Illustration of the method, not measured data.

One hash.
One verdict.

Change a single file and the old numbers stop applying.

Check a skillRead the methodology

One pipeline, three answers.

SKILL.MD + FILESGITHUB URLPASTED TEXTFILE UPLOADREST APIAKULABOUND TO ONE BUNDLE HASHSECURITY SCANfindings by severityPAIRED EVALSdelta per model, 95% intervalCOMPATIBILITYpermissions, activation
Illustration. Paired evals run with API keys in an isolated sandbox.

One upload, the whole package.

Akula pulls in SKILL.md with its scripts, hooks and configs, and hashes every file. Nothing is executed at this stage.

Check a skill

Attacks first, then effect.

The scan looks for known attack patterns. Paired runs then measure whether the skill helps, or quietly hurts, each model.

See the method

A verdict you can audit.

Each report lists its reasons and is bound to one bundle hash. Unmeasured stays visibly unmeasured.

Browse the catalog

Works the way you work.

Send a skill from wherever it lives. Skill code is never run during a scan.

Set it up.

  1. 1

    Point it at Akula.

    Set the address of your Akula instance.

    export AKULA_URL=http://localhost:3000
  2. 2

    Copy the prompt.

    It tells your coding agent to check skills before installing them.

    Before installing any third-party skill in this project, check it with Akula.

- Akula URL: read it from AKULA_URL.
1. POST {AKULA_URL}/api/submissions with {"url": "<GitHub link to the skill>"}. Keep the returned jobId.
2. Poll GET {AKULA_URL}/api/jobs/{jobId} until status is done. Read result.slug.
3. GET {AKULA_URL}/api/skills/{slug} and read report.recommendation and report.reasons.
4. Show me the recommendation, its reasons and any critical or high findings.

Do not install the skill until I have confirmed. Treat "unmeasured" as unknown, never as safe.
  3. 3

    Paste it into your agent.

    It submits the skill and reports the verdict before anything is installed.

Four checks. No black box.

Every part of a report says what it measured and what it cannot tell you.

Security scan

report.security

Injections, hidden text, remote code, secrets, persistence

Runs on every submission

Measured effect

report.effect

With and without the skill, 95% interval per model

Measured on selected skills, not on every submission

Compatibility

report.compatibility

Permissions, activation and stability on each model

Permissions always, the rest after measuring

Text review

report.audit

Clarity and contradictions, as an explanation only

Never changes the verdict

Read the methodology

Built for the moment before you trust it.

Developers

See what a skill touches and what the scanner found before it reaches your agent.

report.security

{
  "status": "warn",
  "counts": { "critical": 0, "high": 0, "medium": 1 },
  "coverage": { "scanned": 43, "total": 98 }
}

Shape of the data, with example values.

How these are produced

Bring your skill.

A static report takes seconds, stays on an unlisted link and runs none of your code.

Check a skillBrowse catalog