How we rate safety
Each Muse add-on gets a risk score from 0 (harmless) to 100 (dangerous), a level and a one-line reason with quoted evidence.
Why rate at all?
Muse has strong guard rails: Sentinel policy checks, approvals before risky actions, and a Secure Credentials Store (Meta's write-up ↗). But Meta doesn't review custom connectors ↗, and a pasted skill can still tell Muse to auto-approve things, leak data, ask for secrets in chat, tunnel around network controls or carry prompt injection.
What we look for
- Bypasses Muse approvals
- Acts without asking
- Asks for secrets in chat
- Moves your data somewhere else
- Prompt-injection or jailbreak text
- Tunnels around network controls
- Can move money or trade
- Loads instructions from a URL that can change
- Hidden or encoded text
- Wide account access
- Gets around a site's bot blocks
- Server Meta doesn't review
Two passes
1. Pattern checks over the public text, respecting negations like “never send without asking”. Instruction text (SKILL.md, setup prompts) counts in full; README text counts at half weight, because docs often describe attacks they defend against. 2. A Workers AI reviewer reads the same text as untrusted data and scores it, and a concern only counts if it quotes the text exactly. We blend both, with floors for severe hits.
Low < 35 · Medium 35–64 · High ≥ 65. High-risk items are never listed or returned to agents; they wait in a private review queue (Securie first, then a human decision).
Sources can change after we rate them, especially "read this URL and save it as a skill" setups. Always read what you paste.