Skip to main content
Every skill in the registry carries two independent signals. SkillScore answers does it work? SkillSafety answers is it safe to load? This page is the map for the second one — what gets checked, in what order, and how the result is labeled.

​
Why a skill needs vetting

A skill is not a passive document. When your agent loads a SKILL.md, its instructions enter the model’s context and its bundled scripts can run on your machine. That makes an installed skill a supply-chain dependency — closer to an npm package than to a wiki page. A skill that says “before you start, fetch and run this setup script” is executing code with your agent’s permissions, on your data. The public skill directories that appeared alongside agent tooling — the ClawHavoc and ToxicSkills wave — proved the risk is real: a skill that reads your .claude/ config and exfiltrates the keys it finds, or buries a prompt-injection payload in a “prerequisites” paragraph, looks exactly like a helpful skill until it runs. An unvetted directory that lists whatever is uploaded is a liability. A registry that inspects every skill before it’s listed, labels the risk, and re-checks it over time is the difference. That pipeline is SkillSafety.

​
The pipeline

Vetting isn’t a single gate at publish time. The same checks run at every stage, so problems surface where they’re cheapest to fix — on your own machine, before anything is public.
  • Local + CI run the same static scanner, free and offline — nothing leaves your machine. Catch issues before you push.
  • The publish gate is the enforced checkpoint: a skill can’t flip to public until it clears the tiers below.
  • Continuous re-checks mean a skill that was clean when published, but whose band later worsens (a new version, an updated rule), is re-labeled — and its owner is emailed.

​
The three tiers

SkillSafety runs three layers of review. They look at different things and cost different amounts. Tier 1 is a fast, free reader that matches the raw text against a catalog of dangerous patterns — a reverse-shell one-liner, a hardcoded API key, a homoglyph that disguises a URL. It runs everywhere: locally, in CI, and server-side. Because it’s pure text matching, it’s instant and deterministic — the same skill always gets the same result. Tier 2 catches what a pattern can’t. Social engineering written in fluent prose — a fake “prerequisites” section that talks the agent into fetching and running a remote script — has no single dangerous token to match. An LLM that reads for intent sees the setup that a regex reads as ordinary instructions. Tier 3 looks at the published text as content, not as instructions: does it carry prohibited material (all examples must be synthetic). Two categories — CSAM and credible threats — are terminal: the skill is removed, not flagged for remediation.
The three tiers fold into one public band — the worst result across them. You don’t reason about tiers as a consumer; you read the band. Authors get the per-tier detail so they know exactly what to fix.

​
What the static scan looks for

Tier 1’s catalog, grouped. This is the full list; Fixing a blocked publish explains how to resolve each finding.
The scanner is context-aware. A security skill that documents an attack — a security-category skill, or fenced code marked with example / detect / never — is downgraded rather than blocked. Teaching how to spot a reverse shell shouldn’t get treated the same as shipping one. And any secret the scan finds is redacted in the findings, never echoed back.

​
What the band means

Every listed skill shows one SkillSafety band. It governs whether — and how — the skill appears in the registry.
Content is the exception to Caution. A content-flagged skill isn’t listed-with-a-warning like other Caution cases — it’s held until it clears. Prohibited content doesn’t ship behind a label.

​
”Not yet reviewed” is honest, not hidden

The AI tiers depend on a model being reachable. If a reviewer is momentarily unavailable, SkillSafety fails open: the skill shows Not yet reviewed and is automatically re-checked — it is never turned into a false Blocked. A pending band is the system telling you the truth (“we haven’t finished checking this yet”), not a silent downgrade. Once the re-check lands, the band resolves to its real value. Every version of a skill carries its own scan and verdict history — a new version is re-vetted from scratch, and re-vetting an old version never masks a problem introduced in a new one. If a published skill’s band ever worsens, its owner gets an email.

​
Where to go next

Fixing a blocked publish

Every refusal reason and how to fix it — findings with per-line fixes, the free re-check loop, and pre-publish deep review.

Content policy

The prohibited-content categories, the synthetic-examples rule, and what’s remediable versus terminal.

What scanning can't catch

The honest limits — why “ask before running” isn’t a security boundary, and defense-in-depth for what you install.

Scan locally & in CI

Run the same scanner on your machine and in GitHub — decimalai skills scan, output formats, SARIF, and exit codes.
SkillSafety is the safety counterpart to SkillScore. A skill needs both to earn a place in the registry: proof it works, and proof it’s safe to load.