Archive position — measured, not model output
0 likes on Devpost
2,264 of the 7,856 archived projects have more likes, and 5,592 share exactly 0 — so this project's #6,742 place in the like-ranked listing is a tie-break inside that group, not a ranking.
Projects (log scale)
Likes on Devpost. ▲ marks this project's group.
Show the figures
| Likes | Projects | Share of archive |
|---|---|---|
| 0 | 5,592 | 71.2% |
| 1 | 1,758 | 22.4% |
| 2 | 285 | 3.6% |
| 3–4 | 132 | 1.7% |
| 5–9 | 75 | 1.0% |
| 10+ | 14 | 0.2% |
Executive Summary
What the company appears to be
Skill Passport is a self-reported read-only trust verification tool for public AI-agent skill repositories. It analyzes GitHub-hosted skills using static analysis to compare claimed behavior with actual code behavior, returning a VERIFIED, REVIEW, or HIGH RISK verdict.
What changed
The author states they built this tool in response to a perceived lack of evidence-based trust mechanisms when installing AI agent skills from public repositories. The tool is described as a solution to the problem of trusting unverified skill code without executing it.
Single most important open question
Is there any evidence that developers are currently installing AI-agent skills from public repositories, or that they are actively seeking tools like Skill Passport? The description does not state whether this has happened in practice — only that the author imagined a need and built a solution.
What The Product Actually Is
The description states that Skill Passport is a read-only trust verification tool for public AI-agent skill repositories. It operates by:
- Fetching documentation and source text from GitHub using the GitHub REST API.
- Parsing Python files using Python's standard-library AST module without executing them.
- Deterministically tracing observable behavior related to network, filesystem, shell, and environment-secret access.
- Building a Repository Behavior Profile with file and line evidence.
- Comparing observed behavior against repository claims in README.md, SKILL.md, and supported manifests.
- Returning an evidence-backed verdict: VERIFIED, REVIEW, or HIGH RISK.
The tool is described as not cloning, importing, executing, installing, or modifying the analyzed repository. It includes a terminal version published to PyPI and a web interface built with React and FastAPI.
Evidence
- The author states it uses AST parsing.
- It fetches files via GitHub REST API.
- It returns verdicts based on behavior vs claims.
- It is available as a CLI tool via pipx and a web UI.
Inference The tool is built for AI agent skill repositories, not general code repositories. The author’s framing implies it's intended to be used in the context of AI-agent ecosystems where skills are installed from public sources.
Positioning & Claim Evolution
The description states that Skill Passport was created to address a trust gap in AI agent skill installation: developers currently rely on documentation (README, SKILL.md) and hope it matches the code. The author frames this as a problem of trust without evidence.
The tool is positioned as a way to turn trust decisions into evidence-based reviews before installation.
Evidence
- The author states: “I wanted to turn that trust decision into an evidence-based review before installation.”
- It is described as a solution to the problem of trusting unverified code.
Inference The tool is positioned as a trust verification mechanism, not a general static analysis or security scanner. It is built for AI agent skill ecosystems, not broader software development workflows.
Target Customer & ICP
The description states that Skill Passport is intended for developers who install AI-agent skills from public GitHub repositories. The author frames the tool as solving a problem faced by developers in AI agent ecosystems.
Evidence
- “AI coding agents can install Agent Skills from public GitHub repositories.”
- “Developers often decide whether to trust a skill by reading its README or SKILL.md and hoping the documentation matches the source code.”
Inference The primary user is likely a developer working in AI agent ecosystems, not general software developers. The tool targets those who are actively installing skills from public repositories.
Business Model & Pricing Evidence
Not evidenced.
Evidence needed
- Any mention of pricing, monetization, or business model.
- Whether the tool is open-source, freemium, or paid.
- Any indication of a commercial offering beyond the self-reported project.
Technical & Delivery Signals
The description states that Skill Passport is built with:
- Python (core logic)
- AST parsing
- GitHub REST API
- FastAPI backend
- React frontend
- Server-Sent Events for streaming analysis
- PyPI and pipx for distribution
It includes four fixtures: VERIFIED, REVIEW, HIGH RISK, and a real-world example from Anthropic.
Evidence
- Built with Python, AST, GitHub API, FastAPI, React.
- Published to PyPI via pipx.
- Includes four test fixtures.
- Uses static analysis only (no execution).
Inference The tool is designed for static code analysis, not runtime behavior. It is built with a focus on deterministic, non-executive verification.
Traction & Maturity Signals
Not evidenced.
Evidence needed
- Any usage data.
- Customer adoption or feedback.
- Revenue or monetization.
- Product maturity beyond the hackathon submission.
Competitive Context
Not evidenced.
Evidence needed
- Mention of existing tools in this space.
- Comparison to other trust or verification tools for AI agent skills or code repositories.
- Market positioning relative to similar tools.
Key Risks & Red Flags
- No evidence of real-world usage or adoption: The tool is described as a hackathon submission, with no indication that developers are currently installing AI-agent skills from public repositories or using such tools.
- Limited scope: It only supports Python files and static analysis; it does not cover other languages or runtime behaviors.
- Unproven market need: The author states the problem but does not provide evidence of a market demand for this tool.
- Self-reported validation only: All claims are based on manual verification by the author, with no independent testing or real-world validation.
Diligence Questions To Ask The Founders
- Is there any evidence that developers currently install AI-agent skills from public repositories?
- Have you validated the tool’s effectiveness against real-world skill repositories?
- What is the current adoption rate of AI agent skills in your target ecosystem?
- Are there plans to expand beyond Python or support other languages?
- How do you plan to monetize or scale this tool?
Investment/Partnership Verdict
Not evidenced.
Evidence needed
- Any indication of traction, revenue, or customer data.
- Evidence of a scalable business model.
- Proof of market demand or adoption beyond the author’s own use case.
The description is self-reported and unverified. It describes a tool built in a hackathon context with no evidence of commercial viability, adoption, or traction. The tool appears to be an idea or prototype, not a product with demonstrated market need or business model.
Source
Submitted to the OpenAI 2026 hackathon on Devpost. Project home on DevPost.
The analysis above was generated by a language model from the project's own one-line description. It is not independent research and contains no verified traction, revenue or customer data.