For the past few months, I've been using AI coding agents every day. One thing became obvious very quickly: we happily install third-party skills and agent bundles without asking the same security questions we'd ask of any other dependency. That felt like a blind spot. AgentScan started as a local scanner to inspect agent skills for security issues. While building it, I realized another problem: even if you know how to reject bad skills, it's still hard to find good ones. That led to the Trusted Distribution—a curated collection of engineering workflows, knowledge, templates, and agents that are researched, reviewed, and versioned before release. The scanner will always remain free and open source. The Trusted Distribution is how I plan to sustain the project and continue maintaining high-quality packages. This is the first public release, so I'd genuinely appreciate critical feedback. If something is confusing, missing, or simply not useful, I'd rather hear it now than after the tenth release. Thanks for taking a look.