How skills are scanned
Skills are checked by an automated static scanner: every submission before it is reviewed, and published skills again whenever their author or a reviewer asks. Here is what it does, how grades work, and what it cannot catch.
Security grades come from an automated static scan using pattern-based heuristics. They are not a safety certification: a high grade does not guarantee a skill is safe, and a low grade does not prove it is malicious. Review a skill's files before installing it, especially any scripts.
What the scanner does
- Reads every text file in the package (SKILL.md, references, scripts) as plain text.
- Matches patterns for prompt injection, credential harvesting, dangerous shell commands, hidden code execution, data exfiltration, embedded secrets and obfuscation.
- Never runs, imports or evaluates anything it scans.
- Does not run skills in a sandbox. Binary files in scripts/ or agents/ cannot be read, so those skills are marked “needs review” instead of passed.
Grades
Each scan starts at 100 points and loses points per finding (each rule counts once per file). The score maps to a grade:
| Grade | Minimum score |
|---|---|
| A | 90 |
| B | 80 |
| C | 70 |
| D | 60 |
| F | 0 |
- With any critical finding, the grade is at most F.
- With any high finding, the grade is at most C.
- Points lost per finding: critical 40, high 25, medium 10, low 4, info 0.
Checks
| Check | Severity | Category |
|---|---|---|
| Instruction override phrasing | high | prompt injection |
| Tells the model to hide actions from the user | high | prompt injection |
| Asks to reveal the system prompt | medium | prompt injection |
| Persona replacement phrasing | low | prompt injection |
| Asks for credentials | high | credential harvesting |
| Reads credential files | critical | credential harvesting |
| Downloads and executes remote code | critical | shell exec |
| Destructive shell command | critical | shell exec |
| Privilege escalation or permission changes | medium | shell exec |
| Dynamic code evaluation | high | code exec |
| Spawns shell commands | medium | code exec |
| Unsafe deserialization | high | code exec |
| Sends data over the network | low | network |
| URL with a raw IP address | medium | network |
| Embedded private key | critical | secret exposure |
| Embedded access token | high | secret exposure |
| Invisible or bidirectional control characters | high | obfuscation |
Scanner version static-1.0.0.
Limitations
- Pattern matching can miss cleverly reworded or encoded attacks, and can flag harmless text that merely discusses them.
- The public report lists each finding’s severity, title and fix; file and line details are shown only to the skill’s author and reviewers.
- Submissions are also reviewed by a person before they are published. Approving despite unresolved findings is possible only as an explicit, logged override.
Report a problem
If you find a malicious or unsafe skill, use the Report button on its page. Browse skills