Skip to main content

​
Overview

AgentPowers aggregates skills from external registries alongside its own native catalog. When you search, you see two sections: AgentPowers skills first, then skills from each external source (starting with ClawHub). External skills are free, open-source skills hosted on their original registry. AgentPowers proxies the search, handles installation, and runs its full security pipeline before any external skill reaches your machine.

​
How It Works

​
Searching

When you search for a skill, AgentPowers queries its own database and all registered external sources in parallel. Results come back in clearly labeled sections: 
ap search "postgres backup"

── AgentPowers ──────────────────────────────
  pg-backup-pro       $5.00    ✅ pass

── ClawHub ──────────────────────────────────
  postgres-backup     Free     ✅ pass    ★ 4.7  (234 installs)
  pg-dumper           Free     ⚠️ warn    ★ 3.2  (89 installs)
  db-snapshot         Free     —  unscanned
  • pass/warn — AgentPowers has scanned this skill version before
  • unscanned — No one has installed this version through AgentPowers yet; it will be scanned on first install

​
Installing

External skills go through a sandboxed install + security scan flow:
  1. The CLI downloads the skill into a temporary sandbox directory
  2. File contents are hashed (SHA-256)
  3. AgentPowers checks its scan cache for that hash
  4. Cache hit — the cached security result is returned instantly
  5. Cache miss — the full security pipeline runs (static validation, VirusTotal, AI review, agent checks), then caches the result
  6. Pass or warn — files move to ~/.claude/skills/ and a pin is recorded
  7. Block — findings are displayed and the skill is not installed

​
Version Pinning

Every installed skill is pinned by its content hash in ~/.agentpowers/pins.json. This protects against supply chain attacks:
  • If an author re-uploads a skill (files change), the hash changes
  • On update, AgentPowers detects the mismatch and re-scans before applying
  • Run ap verify to check all installed skills against their recorded hashes

​
Security

External skills receive the same security treatment as native AgentPowers skills:
CheckDescription
Static validationFile type checks, dangerous pattern scanning
VirusTotalMalware detection across 70+ engines
AI security reviewSemantic analysis for injection, auth flaws, data exposure
Agent-specific checksTool audit, instruction analysis, trust scoring
The only difference: native skills are scanned at publish time. External skills are scanned at install time (and cached for subsequent users).

​
Supported Sources

SourceStatusSkills
ClawHubActiveCommunity skills for Claude Code
More comingPlannedAdditional registries in the future

​
For Developers

​
API

The API provides several endpoints for working with external skills and scan results: Search Results 
GET /v1/search?q=postgres&type=skill
Returns a sectioned catalog with external items including:
  • source — “agentpowers”, “clawhub”, etc.
  • source_url — Link to the original registry entry
  • source_security — Security status from the original source
  • source_rating — Community rating (if available)
  • source_installs — Download count from the original source
  • ap_security_status — AgentPowers scan result (“pass”, “warn”, or “block”)
  • ap_scan_hash — SHA-256 content hash of the scanned version
Scan Cache Lookup Check if a specific content hash has been scanned: 
GET /v1/security/check/{content_hash}
Returns the cached security result instantly if available, or indicates no cached result. Triggering a Security Scan For advanced use cases, initiate a security scan on a package: 
POST /v1/security/scan-package
Content-Type: application/octet-stream

[binary package data]
Returns the security scan result (pass/warn/block) with detailed findings.

​
CLI

The ap install command automatically detects external skills by their source field and routes through the sandbox + scan flow. No special flags needed. The ap verify command checks all installed skills for integrity: 
ap verify
This compares each skill’s current content hash against its recorded pin in ~/.agentpowers/pins.json.