Reports and moderation in the plugin library
A report tells Athenode's administrators that a library entry holds malicious instructions, spam, content that infringes someone's rights or another problem. A library entry is a plugin published to the plugin library, the shared catalogue of plugins that projects have published, and a plugin is a named bundle of what your AI coding tools work with: skills, agents, rules, MCP servers and plugin files. Anyone with an Athenode account can report an entry, Athenode scans every entry automatically when it is published, and an administrator who finds a problem bans the entry from public display or deletes it.
An installed plugin instructs your AI coding agent inside your repository, so read an entry before you add, merge or install it, as Plugin library describes. A report is for an entry that should not be offered to anyone.
Report a library entry
You report an entry from its page on the Athenode website at lib.athenode.com, signed in with your Athenode account. Select Report on the entry's page. Athenode's web app opens Report a library entry, with the entry's slug after "Entry:", and asks you to sign in first if you are not.
Choose a Reason: Malicious instructions, Spam, Rights infringement or Other. Describe the problem under Comment (optional), in up to 2,000 characters. Naming the skill, agent or file concerned and what it does helps the administrator find it. Select Send report. Athenode confirms with "Thank you for your report" and "An administrator will review the entry."
| Limit | What you see at the limit |
|---|---|
| One open report per entry for each account. You can report the entry again once an administrator has dealt with your report | "You have already reported this entry. An administrator will review it." |
| 10 reports from one account in any 24 hours | "You have sent too many reports. Try again later." |
| Only entries shown on the Athenode website can be reported | "This entry cannot be reported: it is not shown in the public library." |
An entry that is not on the Athenode website, because its public display is off or it is banned, is already out of reach of every project that does not have it, as Public display of an entry describes.
What happens after a report
Every report goes to Athenode's administrators. Reports are not shown to the publisher, so the publisher is not told that the entry was reported or by whom.
While an entry has an open report, search engines are asked to leave its pages out of their results. The entry stays on the Athenode website and in the library, and projects can go on adding, merging and installing it until an administrator decides.
An administrator who reviews the report does one of three things:
- Dismisses the report when the entry needs no action. Search engines may list the entry's pages again.
- Bans the entry from public display, as A ban from public display describes.
- Deletes the entry from the library, for everyone. Projects that added a plugin from it keep that plugin, which receives no further updates.
The automatic content scan
Athenode scans an entry at its first publication, at each new version and when its publisher turns public display on again. The scan reads the texts of the skills and their text bundle files, the agents, the rules, the plugin files and the commands, arguments, URLs and values of the MCP servers.
The scan looks for content that is often used to attack an AI agent:
- a command that downloads a script and runs it in a shell;
- a long block of encoded data;
- hidden characters, which an AI tool reads and a person does not see;
- text that tells an agent to ignore or replace its instructions.
A hit opens a report with the reason Malicious instructions, unless the entry already has an open report, and an administrator reviews it like any other report. The scan never refuses or delays a publication, and the publisher is not told about a hit. On the Athenode website, hidden characters in an entry's texts appear as visible markers, so every reader can see them.
A ban from public display
A ban takes an entry off the open web while it stays in the library. An administrator bans an entry with one of the same reasons as a report: Malicious instructions, Spam, Rights infringement or Other. While the ban lasts:
- The entry is not on the Athenode website, whatever its public display setting.
- It cannot be found, added or merged from the Library page of the daemon or of Athenode Pro, and
athenode usecannot install it. - Plugins that projects added from it keep working and get no updates.
- Signed-in users of Athenode's web app see it, with its whole content.
- Its publisher can turn public display off and cannot turn it on, and a new version is published to the library only.
The ban leaves the publisher's own setting as it is. When an administrator lifts the ban, that setting applies again: an entry whose public display is on returns to the Athenode website, and the plugins added from it get updates again. Manage your entries shows what the publisher sees in their Athenode account during a ban.
The publisher's notice of a ban
Athenode emails the publisher when it bans an entry. The subject names the entry and says that it is off the public site, and the email gives the reason for the ban. The email goes to the address of the Athenode account that published the entry. For an entry of an organisation, it goes to the organisation's billing email, or to every billing administrator when the organisation has none.
A publisher who thinks the decision is a mistake can appeal by writing to support@athenode.com, as the email says.