agentsclimarketplace

Agent skill trust check

Skill aiskillstore/marketplace/skills/tatelyman/agent-skill-trust-check

Security-audited skills for Claude, Codex & Claude Code. One-click install, quality verified.

Install
npx -y skills add aiskillstore/marketplace --skill agent-skill-trust-check

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.

What its author says it does

Copied from the file, not written here

Static pre-install trust review for SKILL.md, OpenClaw, Hermes, MCP, and agent-skill marketplace packages before they request local, account, payment, or external access.

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.8 KB, as published. Nobody here has run it

Agent Skill Trust Check

Use this skill before installing a third-party agent skill, SKILL.md package, MCP-linked skill, or marketplace listing.

What This Skill Does

  • Reads a public or local skill description before install.
  • Flags patterns that deserve review: shell execution, destructive commands, secrets, wallet/payment actions, network output, persistence, and prompt-boundary issues.
  • Separates basic provenance signals from risky behavior signals.
  • Produces a patch order that a maintainer can resolve before the skill is trusted.

When To Use

Use this when an agent is about to install or recommend a skill from:

  • OpenClaw, Hermes, or ClawHub-style marketplaces.
  • Claude Code, Codex, Cursor, Windsurf, or Gemini skill directories.
  • MCP-linked skill bundles.
  • GitHub repositories that include a SKILL.md, tool manifest, or install script.

Run From The Public Repo

git clone https://github.com/TateLyman/agent-skill-trust-check.git
cd agent-skill-trust-check
npm run check
node bin/agent-skill-trust-check.js ./SKILL.md

Marketplace-safe stdin mode:

node bin/agent-skill-trust-check-stdin.js < ./SKILL.md

For JSON output:

node bin/agent-skill-trust-check.js ./SKILL.md --json

npm command:

npx --yes agent-skill-trust-check ./SKILL.md --json

Review Rules

Before installation, check:

  • Does the skill run shell commands, package installers, or process-spawn APIs?
  • Does it read secrets, environment variables, wallet data, credentials, cookies, or private keys?
  • Does it send content to remote URLs or webhooks?
  • Does it create persistent background jobs?
  • Does it ask the agent to ignore or override higher-priority instructions?
  • Does it document source, license, version, tests, permissions, and uninstall steps?

Boundaries

This is a static pre-install check. The marketplace-safe runner reads only stdin and returns JSON. The local CLI can also read a local path or a public GitHub/raw/Gist URL when run from the repository checkout. Neither mode executes the target skill or proves the runtime is safe.

For marketplace-grade review, use the paid Agent Skill Trust Check listing:

https://orkai.ai/skills/agent-skill-trust-check

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.