I kept seeing AI skills that were easy to install but hard to inspect. USB is my attempt at a trust layer: it discovers capabilities in a repo, checks what they claim against what they actually contain, and observes MCP servers before letting them into a workflow. The project is still evolving, but the scanner, MCP probe, installer, and test corpus are all in the repo.