Every skill, vetted.
Skills run inside Roumora's built-in AI chat, so they're held to a higher standard than ordinary content. Every upload to Roumora passes through an automated security pipeline before it can be published. No exceptions, including our own.
Five checks on every upload
Each skill file is scanned the moment it's uploaded, before anyone can install it.
Malware & destructive commands
The scanner flags payloads and destructive instructions hidden in skill files, things like disk-wiping commands, fork bombs, and code designed to cause damage if it were ever followed.
Prompt injection
Skills are checked for attempts to hijack the AI: hidden or zero-width Unicode characters that conceal instructions, jailbreak phrasing, and text crafted to override the chat's rules.
Leaked secrets
Uploads containing credentials, AWS keys, API keys, private keys, tokens, are caught before they're ever distributed, protecting both creators and users.
Phishing & suspicious links
Obfuscated URLs and link shorteners that could route you to malicious destinations are detected and surfaced.
Structure validation
Every file must match the expected skill format and size limits, so malformed or bloated packages never make it into the marketplace.
Clear verdicts, no gray areas
Every scan ends in one of three outcomes.
No findings. The skill is cleared for publishing and marked as scanned on its listing.
Something looks off. Medium-severity findings hold the skill back until they're resolved.
High or critical findings block the skill outright. It never reaches the marketplace.
Beyond the scanner
Versioned and re-checked. Skills are versioned, and every new version goes through the same pipeline as the first upload. A clean history yesterday doesn't skip the scan today. Each release is checked with a recorded scanner version and timestamp.
Community trust signals. Ratings, reviews, install counts, and creator reputation sit on top of the automated checks, so quality and trustworthiness are visible before you install anything.
Defense in depth. The pipeline is built to grow. An AI-powered review pass is designed into the scanner so new attack patterns can be caught as they emerge, not just the ones on a fixed list.
Install with confidence
Every skill in the marketplace has been through the pipeline. Go find the one you need.