Home › AI agent skills › How we review AI agent skills

How we review AI agent skills

Each entry of the catalog shows what we read, on which version and on which date. Last update of this method: October 25, 2026.

The real risks of agent skills

• Scripts that run on your machine. A skill can ship scripts that the agent runs with your user rights. A study of 31,132 public skills found at least one dangerous pattern in 26.1% of them, and 5.2% with high-severity patterns; skills with scripts were about twice as likely to be vulnerable (arXiv 2601.10338, January 2026).
• Malware passed off as a prerequisite. In February 2026, Koi Security reported 341 malicious skills on ClawHub, the OpenClaw skills registry, most of them asking users to install a fake prerequisite that delivered an information stealer (Koi Security, The Hacker News). Trend Micro described 39 skills that led the agent to download Atomic macOS Stealer (Trend Micro).
• Hidden instructions and prompt injection. Snyk scanned 3,984 skills and found security flaws in 36.82% of them and 76 confirmed malicious payloads, including instructions hidden in SKILL.md files (Snyk ToxicSkills).
• Data sent out and broad access. Anthropic advises using skills only from trusted sources and auditing every bundled file, because a malicious skill can make the assistant misuse tools, read files or send data out (Claude documentation). Stanford University IT gives the same advice (Stanford UIT).
• Unpinned code and unknown authors. A command such as npx package@latest fetches whatever version is current on each run. OWASP lists supply chain, over-broad permissions and unverified publishers among the ten main risks of agent skills (OWASP Agentic Skills Top 10).
• Permission fields are not a sandbox. The allowed-tools field of the SKILL.md format is experimental (specification), and Grok Build states that it does not grant or restrict any tool (xAI documentation).

Our checklist (passive review)

1. We note the exact commit we read, with its date, and count the SKILL.md files, files and scripts. Copies are counted once: mirror folders of the same skills, and identical files repeated in several skills.
2. We read every SKILL.md: what it asks the agent to do, hidden or unusual instructions (white text, HTML comments, encoded text, instructions to ignore the user or hide actions).
3. We read the scripts, the configuration and the hooks, and search the whole repository for risky patterns: network calls, curl | bash, encoded commands (base64, eval), access to keys, tokens, SSH files or browser data, writes outside the project, persistence.
4. We list what the skill can do, the files it touches, the services it calls and the credentials it uses.
5. We check how it installs: pinned version or latest, number of dependencies, hosted parts we cannot read.
6. We check the author (platform, vendor of the service, or community), the licence and, for social media, the platform rules.
7. Large repositories: we read the SKILL.md files, the configuration and every line flagged by the search, and say so in a warning.

Built from the OWASP skill security checklist and the Anthropic advice above.

Trust levels

• ✓ Reviewed with our method Public code read, no red flag, no warning. 25 entries.
• ⚠ Reviewed, with warnings Public code read, no red flag, but at least one warning: scripts that run locally, data sent to a third-party service, actions taken on your behalf (sending, publishing, spending), unpinned version, many dependencies, partial review, hosted part, platform rules. 85 entries.
• ○ Not reviewed Code not public or not read, or a new submission. We only describe what the publisher documents. 40 entries.
• Excluded. A red flag (hidden instructions, exfiltration, obfuscated code, malware download, credential theft) means the skill is not listed. None of the entries reviewed so far had one.

What we do not do

• We never run a skill, a script or an installer, and we never test a third-party service or system.
• "Reviewed" is not a guarantee. A human review can miss something, a new version can change the code, and an MCP server or a service can change on its side.
• We do not review the AI assistant itself, the services a skill connects to, or third-party code it downloads at run time.
• Nobody can pay for a trust level, and affiliate links never change the order.

Re-reviews

Each review covers one commit. When the code changes, the date and the commit on the page show which version we read; we review again before changing the level. If you see a problem in a listed skill, tell us through the submission form and we will check it again. Submit or report a skill →

What you can do

• Install from the official repository, pinned to a commit or a release when you can.
• Read the SKILL.md and the scripts before the first run, and again after an update.
• Give the narrowest access: read-only keys, a test account, no production credentials.
• Keep approval on for actions that send, publish or spend, and treat web pages and emails read by the agent as untrusted content.

See the catalog (150) →