> For the complete documentation index, see [llms.txt](https://whitepaper.gopluslabs.io/goplus-network/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://whitepaper.gopluslabs.io/goplus-network/web3-security/safuskill.md). # GoPlus SafuSkill ## Overview GoPlus SafuSkill is the trusted distribution layer for AI agent software within the GoPlus Web3 Security product line. As agents increasingly depend on third-party skills, scripts, and reusable code, risk can enter the execution path through the software they rely on long before an action reaches a model, an application, or a blockchain. A compromised skill can carry malicious commands, credential theft, hidden network calls, or prompt-injection payloads into an agent environment with no blockchain interaction at all. Launched by GoPlus in March 2026, SafuSkill brings together software discovery, security assessment, and distribution within a single platform. It aggregates AI skills at scale, scans them for supply-chain risk, and surfaces verified software to developers and autonomous agents through the GoPlus marketplace and partner distribution channels. ## Why the Agent Software Supply Chain Needs Security In GoPlus' assessment of the most-downloaded skills on a major agent skill hub in early 2026, roughly one in five was classified as high-risk and recommended for blocking, and a further one in six carried medium-risk warnings. Agent skill ecosystems are growing faster than the security review around them. Skills are unusual dependencies. They are installed by agents, often at the agent's own initiative, and they can grant the agent new capabilities that reach credentials, files, networks, and financial infrastructure. Verifying third-party components is therefore a core part of execution security, not an optional step. ## Core Capabilities ### Discovery and Aggregation SafuSkill aggregates AI skills across public hubs, repositories, and partner ecosystems, giving developers and agents a single place to find software and see its security status. ### Security Scanning Every aggregated skill can be scanned for malicious commands, credential theft, data exfiltration, unsafe network behavior, prompt-injection payloads, and other supply-chain risks. Scanning draws on GoPlus Intelligence and shares detectors with GoPlus AI Security's runtime deep scan. ### Verification and Trust Signals Scanned software receives a security assessment that is surfaced at the point of discovery and installation, so developers and agents can make a trust decision before software enters the operating environment. ### Ongoing Monitoring A skill that is safe today can become unsafe as its code changes, its dependencies evolve, or new attack techniques emerge. SafuSkill supports continued monitoring of distributed software, complemented by GoPlus AI Security's daily patrol of installed components. ### Distribution Modes SafuSkill operates through two complementary models: * **Skill Mode** allows developers to publish AI-agent skills that have gained traction and distribute them through the platform. * **Code Mode** links distributed assets to GitHub repository branches so that what is distributed remains connected to the underlying software as it evolves. Issuance and distribution are supported through partner launch infrastructure, and GoPlus operates a growth fund to support projects building on SafuSkill. ### Partner Distribution SafuSkill extends beyond GoPlus' own marketplace through integrations with agent ecosystems, wallet skill indexes, and agent terminals, creating additional routes through which assessed software can reach developers and autonomous agents. ## SafuSkill and $GPS SafuSkill's connection to $GPS runs through security consumption, not through the tokenization of skills. As third-party software becomes a core dependency of autonomous agents, discovery, scanning, verification, and ongoing monitoring each become independently consumed security services. GoPlus intends for $GPS to provide a common settlement layer across these security interactions, connecting trusted software distribution with the broader security-service economy: * **Scan, verify, monitor:** Developers, platforms, and skill hubs that request scanning, verification, or continued monitoring of software consume security services settled in $GPS. * **Agent-originated checks:** When an agent checks a skill before installing it, that check is a machine-originated security transaction that GoPlus intends to settle in $GPS, in the same way as AI Agent Security API calls. * **Supply side:** Scanning capacity and threat intelligence for skills, packages, and MCP servers are produced by Security Compute Layer operators and data contributors who stake and earn $GPS. The chain is: skill, then scan, verify, and monitor, then security service, then $GPS settlement. ## SafuSkill in the GoPlus Security Layer SafuSkill is the software supply-chain layer of GoPlus' execution security architecture. It sits within the GoPlus Web3 Security product line alongside DeepScan, SafeToken Protocol, and transaction protection, because the skills it secures are increasingly the software through which agents reach wallets, tokens, contracts, and on-chain applications. * **GoPlus AI Security** enforces policy on the actions agents take once software is installed, and its deep scan and daily patrol capabilities share detectors and intelligence with SafuSkill. * **GoPlus Intelligence** provides the malicious package, URL, and prompt-injection intelligence that scanning relies on. * **Security Data Layer** receives verified reports of malicious skills, packages, and MCP servers, improving coverage for the whole network. * **DeepScan** and **GoPlus Web3 Security** protect the contracts and transactions that agents running verified skills may ultimately interact with. Together, SafuSkill, GoPlus AI Security, DeepScan, and GoPlus Intelligence cover the systems agents depend on, the decisions they make, the contracts they touch, and the environments in which those decisions are executed. ## Use Cases **Agent developers** Discover skills with security status attached, verify dependencies before shipping, and keep distributed software connected to its source. **Skill hubs and agent platforms** Use SafuSkill as the security-scanning layer for submitted skills, so that users of the platform see assessed software by default. **Autonomous agents** Check a skill, package, or MCP server before installation as a machine-originated security transaction. **Wallets and trading terminals** Index and surface verified skills to users and agents that operate financial workflows. ## Conclusion SafuSkill embeds security assessment into the distribution of AI agent software, so that risk is identified before it becomes part of an agent's operating environment. As the agent software supply chain grows, the security services around discovery, scanning, verification, and monitoring grow with it, and $GPS is intended to be the unit in which that consumption is settled.