I kept seeing AI skills that were easy to install but hard to inspect. USB is my attempt at a trust layer: it discovers capabilities in a repo, checks what they claim against what they actually contain, and observes MCP servers before letting them into a workflow. The project is still evolving, but the scanner, MCP probe, installer, and test corpus are all in the repo.

The problem is AI generates so much text that we can’t even read what is claimed on a landing page. Most people are installing things they don’t even read, so verifying against what is claimed, while great, has limitations.

Why would you name it USB? This just makes it harder to search for and harder to communicate about. Just name it... I don't know, something else.