Safety posture
Every skill we check might be hostile. We work like it is.
The server that checks a skill never runs it, can reach three hosts and no others, and hands your agent nothing a poisoned skill could steer it with. Here is each rule, with its numbers.
We never run the code we check
The scanning server only reads. A skill’s files are unpacked in memory for the length of one check, never written to disk and never executed. Running untrusted code is the sandbox’s job, and the sandbox is another machine.
- Files
- In memory, for one check
- On the scanning server
- Nothing from the skill runs
- Sandbox
- A separate gVisor or Firecracker machine with no secrets of ours on it, 90 seconds per run, every network call through a logging proxy
Your link never picks the server
Whatever you paste, BUFONITE turns it into a request to one of three hosts it knows, over HTTPS. A link can’t make it fetch from anywhere else, and that includes our own network. Redirects are capped, and each one is checked against the same list.
- Hosts
api.github.com,codeload.github.com,registry.npmjs.org- Redirects
- Three at most, each one re-checked
Bombs and padding don’t get through
Sizes are counted while the download streams in, so a zip bomb or a gzip bomb stops at the limit instead of filling memory. A file past the read limit is cut, but its non-blank lines after the cut are still read, so a payload can’t hide behind a megabyte of blank lines.
- Download
- 25 MB, packed
- Files
- 3,000
- Read per file
- 512 KB, then the non-blank lines after it
- Documents
.docx,.xlsx,.pptx, OpenDocument and.zipare opened in memory and recognised by their bytes, not their names: hidden text, hidden sheets and slides, macros, paths that climb out
What we read is what was published
A branch or a tag can move; a commit can’t. Every link is pinned to one commit SHA or one exact version before anything is read, and the report names it. An npm tarball is checked against the registry’s checksum before it’s unpacked.
- GitHub
- The full commit SHA
- npm
- The exact version, its
sha512integrity verified - A new push
- A new commit, so a fresh check, never an old grade
A poisoned skill can’t talk to your agent through us
Names and paths from a scanned package end up in your agent’s context, so they get the same treatment our hidden-text rules look for: no control, zero-width, bidi or tag characters, one line, clipped. The raw evidence never goes back over MCP, and every answer reminds the agent that those strings are data, not instructions.
On this site the report is shown as text only, and invisible characters are written out, as <U+200B>, so you see what your agent would have been fed.
Evidence, not accusations
A false “poisoned” hurts a real author. So static rules and the models can say “suspicious” at most, and only the sandbox, with a planted secret caught leaving the box, can close a skill. Every finding carries its file, its line and the line itself, and every report can be checked again.
- Static, LLM review
- C at most
- Classifier
- B at most
- Sandbox
- The only course that can say CLOSED
What a grade doesn’t promise
An A means no red flags in the files BUFONITE read, at that commit. It isn’t a promise about the next commit, about code the skill downloads later, or about what the author meant. A course that didn’t run shows as skipped in the report, and the grade rests only on the courses that did.
Reports are public
BUFONITE checks public repositories and packages, and its reports are public too: anyone with a report’s link can open it, and the latest checks are listed on the check page and in the API. Each check keeps its report: the target, the findings with their excerpts, the hosts and the timings.