topskills

Guide

How to audit an agent Skill before you install it

Audit a Skill by reading its SKILL.md in full, checking who published it and under what licence, inspecting every bundled script, and listing the credentials and network access it asks for. A Skill is not passive data — it is instructions your agent will follow, and it can ship executable code, so installing one is a supply-chain decision. Ten minutes of reading catches nearly everything: the risky Skills are almost never subtle.

Updated August 19, 2026 · first published August 19, 2026

Why this is a real risk category

Three properties make Skills different from a document you paste into a chat. They persist, so one install influences every future session. They can bundle scripts, which a terminal agent will execute. And they are trusted by construction: the agent treats the instructions as guidance from you, not as untrusted input.

The realistic failure is rarely deliberate malware. It is a Skill that tells the agent to run a broad command, wants a token with more scope than the task needs, or quietly instructs it to send repository contents to a third-party endpoint for "analysis". None of that requires bad intent to hurt you.

The audit, in order

Work top to bottom and stop at the first thing you cannot explain.

Read the whole SKILL.md
Not the README — the SKILL.md, because that is what the agent reads. If it is too long to read, it is too long to trust unread.
Establish the publisher
Is this the vendor’s own GitHub organisation, or a lookalike? A skill claiming to be a company’s official integration should live in that company’s org. Check the org, not the repo name.
Confirm the licence from the file
Read the LICENSE file, not a README badge. We have found repos whose badge claims Apache-2.0 while the linked LICENSE returns 404, and repos with a licence declared only in SKILL.md frontmatter. No licence file means all rights reserved by default.
Open every bundled script
Scripts are the executable surface. Look for network calls, credential reads, shell-outs, and anything writing outside the working directory.
List what it wants access to
Which environment variables, which API keys, which MCP servers, which allowed-tools. A Skill that reads more secrets than its job requires is a problem even if it is honest.
Check for instruction laundering
Be wary of a Skill that tells the agent to fetch further instructions from a URL at runtime. That moves the trusted content outside the file you audited.
Check maintenance
Last commit date, open issues, whether the repo is archived. An abandoned Skill that names a deprecated API is a correctness risk rather than a security one, but it still costs you.

Reduce blast radius rather than trusting harder

Scope the install: project-local rather than user-wide keeps a Skill from following you into unrelated repos. Prefer read-only Skills where they will do — the capability level is on every entry on this site for exactly this reason.

Keep credentials out of reach. If a Skill needs an API key, give it a scoped key for that purpose, not your general-purpose token, and never a production credential for a development workflow. Try new Skills on a scratch repo before a real one.

Pin what you depend on. In production — a Claude API integration, a CI job — treat a Skill like any dependency: pin the version you tested and read the diff before upgrading.

What the tiers actually tell you

Provenance is a prior, not a verdict. An Anthropic-published Skill has been through a review process you cannot replicate; a vendor Skill has the vendor’s reputation attached and tracks their own API; a community Skill has whatever the author gave it, which is sometimes excellent and sometimes a weekend project.

Popularity is the weakest signal of the three. Install counts and stars measure reach, not review, and a Skill can be widely installed and still ask for more access than it needs. Read it anyway.

FAQ

Common questions

Are agent Skills safe to install?

They are as safe as the instructions and scripts inside them, which is why reading the SKILL.md before installing is the whole answer. Skills from Anthropic and from vendors’ own organisations carry meaningfully more accountability than an unknown repo, but the read is cheap enough that there is no reason to skip it.

Can a Skill run code on my machine?

A Skill can bundle scripts, and a terminal agent with your approval can run them. That is a feature — deterministic scripts are more reliable than re-improvised code — but it means bundled scripts deserve the same scrutiny as any dependency you execute.

What is the single biggest red flag?

Instructions telling the agent to fetch and follow content from a URL at runtime. It moves the real instructions outside the file you reviewed, so nothing you audited constrains what runs later.

Does a permissive licence mean it is safe?

No. A licence tells you what you may legally do with the code, not whether the code is sound. Both matter, separately: check the licence for your compliance obligations and read the content for risk.

How often should I re-audit?

When you upgrade, and when a Skill starts mattering more than it did. A Skill that moves from a scratch project into your deploy pipeline should get a fresh read at that point, not the one it got when you were experimenting.

Related

Keep reading