Archive position — measured, not model output
0 likes on Devpost
2,263 of the 7,850 archived projects have more likes, and 5,587 share exactly 0 — so this project's #6,736 place in the like-ranked listing is a tie-break inside that group, not a ranking.
Projects (log scale)
Likes on Devpost. ▲ marks this project's group.
Show the figures
| Likes | Projects | Share of archive |
|---|---|---|
| 0 | 5,587 | 71.2% |
| 1 | 1,758 | 22.4% |
| 2 | 284 | 3.6% |
| 3–4 | 132 | 1.7% |
| 5–9 | 75 | 1.0% |
| 10+ | 14 | 0.2% |
User Stories BotA demo video on every pull request
Get a demo video on every new feature
GitHub App that watches your pull requests and records a narrated, captioned demo.
Save time on demo prep and make informed decisions faster with a video walkthrough of every new feature.
Executive Summary
What the company appears to be
Skill Passport is a self-reported read-only trust verification tool for public AI-agent skill repositories. It analyzes GitHub-hosted skills using static analysis to compare claimed behavior with actual code behavior, returning a VERIFIED, REVIEW, or HIGH RISK assessment.
What changed
The author states they built this tool in response to a perceived lack of evidence-based trust mechanisms when installing AI agent skills from public repositories. The tool is described as a solution to the problem of trusting unverified skill code without executing it.
Single most important open question
Is there any evidence that developers are currently installing AI-agent skills from public repositories, or that they are actively seeking tools like Skill Passport? The description does not state whether this has happened in practice — only that the author imagined a need and built a solution.
What The Product Actually Is
The description states that Skill Passport is a read-only trust verification tool for public AI-agent skill repositories. It operates by:
- Fetching documentation and source text from GitHub using the GitHub REST API.
- Parsing Python files using Python's standard-library AST module without executing them.
- Deterministically tracing observable behavior related to network, filesystem, shell, and environment-secret access.
- Building a Repository Behavior Profile with file and line evidence.
- Comparing observed behavior against repository claims in README.md, SKILL.md, and supported manifests.
- Returning an evidence-backed assessment: VERIFIED, REVIEW, or HIGH RISK.
The tool is described as not cloning, importing, executing, installing, or modifying the analyzed repository. It includes a terminal version published to PyPI and a web interface built with React and FastAPI.
Evidence
- The author states it uses AST parsing.
- It fetches files via GitHub REST API.
- It returns assessments based on behavior vs claims.
- It is available as a CLI tool via pipx and a web UI.
Inference The tool is built for AI agent skill repositories, not general code repositories. The author’s framing implies it's intended to be used in the context of AI-agent ecosystems where skills are installed from public sources.
Positioning & Claim Evolution
The description states that Skill Passport was created to address a trust gap in AI agent skill installation: developers currently rely on documentation (README, SKILL.md) and hope it matches the code. The author frames this as a problem of trust without evidence.
The tool is positioned as a way to turn trust decisions into evidence-based reviews before installation.
Evidence
- The author states: “I wanted to turn that trust decision into an evidence-based review before installation.”
- It is described as a solution to the problem of trusting unverified code.
Inference The tool is positioned as a trust verification mechanism, not a general static analysis or security scanner. It is built for AI agent skill ecosystems, not broader software development workflows.
Target Customer & ICP
The description states that Skill Passport is intended for developers who install AI-agent skills from public GitHub repositories. The author frames the tool as solving a problem faced by developers in AI agent ecosystems.
Evidence
- “AI coding agents can install Agent Skills from public GitHub repositories.”
- “Developers often decide whether to trust a skill by reading its README or SKILL.md and hoping the documentation matches the source code.”
Inference The primary user is likely a developer working in AI agent ecosystems, not general software developers. The tool targets those who are actively installing skills from public repositories.
Business Model & Pricing Evidence
Not evidenced.
Evidence needed
- Any mention of pricing, monetization, or business model.
- Whether the tool is open-source, freemium, or paid.
- Any indication of a commercial offering beyond the self-reported project.
Technical & Delivery Signals
The description states that Skill Passport is built with:
- Python (core logic)
- AST parsing
- GitHub REST API
- FastAPI backend
- React frontend
- Server-Sent Events for streaming analysis
- PyPI and pipx for distribution
It includes four fixtures: VERIFIED, REVIEW, HIGH RISK, and a real-world example from Anthropic.
Evidence
- Built with Python, AST, GitHub API, FastAPI, React.
- Published to PyPI via pipx.
- Includes four test fixtures.
- Uses static analysis only (no execution).
Inference The tool is designed for static code analysis, not runtime behavior. It is built with a focus on deterministic, non-executive verification.
Traction & Maturity Signals
Not evidenced.
Evidence needed
- Any usage data.
- Customer adoption or feedback.
- Revenue or monetization.
- Product maturity beyond the hackathon submission.
Competitive Context
Not evidenced.
Evidence needed
- Mention of existing tools in this space.
- Comparison to other trust or verification tools for AI agent skills or code repositories.
- Market positioning relative to similar tools.
Open Questions & Risks
- No evidence of real-world usage or adoption: The tool is described as a hackathon submission, with no indication that developers are currently installing AI-agent skills from public repositories or using such tools.
- Limited scope: It only supports Python files and static analysis; it does not cover other languages or runtime behaviors.
- Unproven market need: The author states the problem but does not provide evidence of a market demand for this tool.
- Self-reported validation only: All claims are based on manual verification by the author, with no independent testing or real-world validation.
Questions the description leaves open
- Is there any evidence that developers currently install AI-agent skills from public repositories?
- Have you validated the tool’s effectiveness against real-world skill repositories?
- What is the current adoption rate of AI agent skills in your target ecosystem?
- Are there plans to expand beyond Python or support other languages?
- How do you plan to monetize or scale this tool?
Overall Assessment
Not evidenced.
Evidence needed
- Any indication of traction, revenue, or customer data.
- Evidence of a scalable business model.
- Proof of market demand or adoption beyond the author’s own use case.
The description is self-reported and unverified. It describes a tool built in a hackathon context with no evidence of commercial viability, adoption, or traction. The tool appears to be an idea or prototype, not a product with demonstrated market need or business model.
User Stories BotA demo video on every pull request
Get a demo video on every new feature
GitHub App that watches your pull requests and records a narrated, captioned demo.
Save time on demo prep and make informed decisions faster with a video walkthrough of every new feature.
Source
Submitted to the OpenAI 2026 hackathon on Devpost. Project home on Devpost. Back to the full gallery on Devpost.
This competitive analysis was produced by
top-founders.com (opens in a new tab)
Generated by a language model from this project's public Devpost page — its tagline, the author's own write-up and any built-with tags listed there — as captured in August 2026. Short quotations are the author's words. It is an opinion on the idea as a business, not on the people behind it, and it reflects the description as published then. If the project has moved on, request a correction below. The analysis is not independent research and contains no verified traction, revenue or customer data.
An independent guide by KFG International LLC — not affiliated with, endorsed by, or connected to Devpost or OpenAI.