Agent skill trust check skills tatelyman agent skill trust check skills agent skill trust check
全球最大的 Claude Code 技能聚合库 · 收录 3900+ 来自 12+ 来源的技能，提供在线搜索与趋势分析看板 / The world's largest Claude Code skill aggregation hub — 3900+ skills from 12+ sources with online search and trend dashboard
npx -y skills add bg-szy/TOP-SKILLS --skill agent-skill-trust-check__skills-tatelyman-agent-skill-trust-check-skills-agent-skill-trust-checkAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 4 stars4 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Static pre-install trust review for SKILL.md, OpenClaw, Hermes, MCP, and agent-skill marketplace packages before they request local, account, payment, or external access.
The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
3.8 KB, 510 tokens by cl100k_base, as published. Nobody here has run it
Agent Skill Trust Check
Use this skill before installing a third-party agent skill, SKILL.md package, MCP-linked skill, or marketplace listing.
What This Skill Does
- Reads a public or local skill description before install.
- Flags patterns that deserve review: shell execution, destructive commands, secrets, wallet/payment actions, network output, persistence, and prompt-boundary issues.
- Separates basic provenance signals from risky behavior signals.
- Produces a patch order that a maintainer can resolve before the skill is trusted.
When To Use
Use this when an agent is about to install or recommend a skill from:
- OpenClaw, Hermes, or ClawHub-style marketplaces.
- Claude Code, Codex, Cursor, Windsurf, or Gemini skill directories.
- MCP-linked skill bundles.
- GitHub repositories that include a
SKILL.md, tool manifest, or install script.
Run From The Public Repo
git clone https://github.com/TateLyman/agent-skill-trust-check.git
cd agent-skill-trust-check
npm run check
node bin/agent-skill-trust-check.js ./SKILL.md
Marketplace-safe stdin mode:
node bin/agent-skill-trust-check-stdin.js < ./SKILL.md
For JSON output:
node bin/agent-skill-trust-check.js ./SKILL.md --json
npm command:
npx --yes agent-skill-trust-check ./SKILL.md --json
Review Rules
Before installation, check:
- Does the skill run shell commands, package installers, or process-spawn APIs?
- Does it read secrets, environment variables, wallet data, credentials, cookies, or private keys?
- Does it send content to remote URLs or webhooks?
- Does it create persistent background jobs?
- Does it ask the agent to ignore or override higher-priority instructions?
- Does it document source, license, version, tests, permissions, and uninstall steps?
Boundaries
This is a static pre-install check. The marketplace-safe runner reads only stdin and returns JSON. The local CLI can also read a local path or a public GitHub/raw/Gist URL when run from the repository checkout. Neither mode executes the target skill or proves the runtime is safe.
For marketplace-grade review, use the paid Agent Skill Trust Check listing:
What ships with it
Read from the repository
Just SKILL.md. No reference files, no scripts.