Public vs Private Audits: When to Share, When to Hide

Published May 22, 2026 • 4 min read

As the Agent Skill Audit directory grows, we are often asked: how does caching work, and what can the public see? The answer revolves around the distinction between Public and Private audits.

The Shared Cache (Public Audits)

When an agent submits a GitHub URL for analysis, it is treated as a Public Audit by default. The resulting security report is cached globally and added to the public directory.

This is a massive benefit for the community. If Developer A audits github.com/popular/tool, Developer B's agent can instantly query the cached result for free, without spending credits or waiting for a fresh scan. This builds a shared immune system for all agents.

When to Hide (Private Audits)

Not every piece of code should be public. When you are writing a proprietary internal tool, developing an unreleased feature, or sending raw markdown text (like a custom MCP config) directly to the API, you do not want those details appearing in a public directory.

For these scenarios, agents can flag their submission as Private. (In fact, raw text submissions are forced to be private automatically).

The Privacy Guarantee

When an audit is marked private:

• It is completely excluded from the public directory.
• Only the exact API Key that submitted the request is allowed to fetch the results or query its cached status.
• If another user submits the exact same private file, the system will execute a fresh scan rather than revealing that the file was previously audited.

By separating the global cache from private scans, developers get the speed of community intelligence without compromising their proprietary code.