PeepSick Labs has released USB v1.0.8, a universal skill bridge that now includes a dedicated trust layer for AI capabilities. The update addresses a critical gap in the agent ecosystem: the inability to verify whether a skill or Model Context Protocol (MCP) server actually performs the actions it claims. By introducing static analysis and live protocol observation, USB moves beyond simple package installation to provide inspectable artifacts for 529 skills across 16 runtime targets.

The Trust Layer Architecture

The core of the v1 update is the separation of verification into two distinct commands: usb secscan and usb mcprobe. The secscan command performs a static, deterministic analysis that compares a skill’s declared contract—its name and description—against observable evidence in the codebase. It flags undeclared capabilities such as credential access, network piping, or destructive deletions, providing file:line evidence for every finding. This ensures that a skill claiming to simply summarize notes isn’t secretly exfiltrating data to a remote endpoint.

Live Runtime Observation

While secscan handles static code, usb mcprobe closes the gap on runtime behavior. This command explicitly consents to running untrusted code, completing the MCP protocol handshake to observe what a server actually exposes during startup. Crucially, mcprobe never calls a tool; it only registers capabilities. This allows developers to see if a server’s declared tools match its actual implementation, detecting contract drift without risking side effects from execution. The report redacts sensitive launch lines and environment values, ensuring security during the audit process.

Universal Installation and Targets

Beyond verification, USB functions as a bridge between skill definitions and diverse AI runtimes. The catalog supports 16 targets, including native installs for Claude Code, Cursor, LeoSis, and Hermes, as well as portable bundles for frameworks like LangChain, OpenAI, and Anthropic. A single skill definition can be compiled into the specific format required by each runtime, eliminating the need for manual rewriting. The installer verifies SHA-256 hashes before execution, providing a supply chain security step often missing from community-driven skill repositories.

Key Takeaways

  • USB v1.0.8 adds secscan for static contract verification and mcprobe for live MCP server observation.
  • The tool supports 529 skills and 16 runtime targets, including native installs for Claude and Cursor.
  • secscan provides deterministic verdicts with file:line evidence, suitable for CI pipelines via exit codes.
  • mcprobe observes MCP handshakes without calling tools, ensuring safe runtime inspection.
  • Installation is universal, compiling single skill definitions into portable bundles for 11 additional frameworks.

The Bottom Line

USB v1.0.8 transforms skill installation from a blind trust exercise into an auditable process. By separating static verification from runtime observation, it provides the transparency needed to secure the rapidly expanding AI agent ecosystem.