Method
How the scan works
We crawl public GitHub for agent skill files, read the text, look for patterns that can hurt you, and assign a grade. This page says what that covers and what it does not.
What we scan
Public files such as SKILL.md, AGENTS.md, Cursor rules, and Claude skills. The crawler keeps searching GitHub. When it finds a listed file has changed, it grades it again. The grader reads that text. We do not execute the skill.
If the file moves, changes, or goes private, the grade can go stale until the next crawl.
Each skill page also notes which tools the skill works in: Claude Code, Cursor, Codex, Gemini CLI, when we can tell.
How grades work
F F
Fetches and runs a remote script (for example curl piped to bash), or reads keys, .env, or .ssh and sends data to an outside URL.
D D
Hidden code or text (base64 plus exec, invisible Unicode, instructions buried in comments), or tells the agent to skip asking the user, ignore its own rules, or use --dangerously-skip-permissions.
Text inside HTML comments gets every check, same as the rest of the file.
"Hidden text spelled in invisible Unicode characters": some invisible characters can spell out words you can't see. We decode them and scan what they say. That's a D, or a worse grade if the hidden text is worse.
"Text pushed below a long run of blank lines": 50 or more blank lines, then instructions for the agent where a reader would stop scrolling. That's a D.
C C
Hardcoded keys in hooks or .mcp.json, sudo, chmod 777, or writes outside the project.
A known official installer piped to a shell gets a C, not an F, when the line is exactly the vendor's documented command. The list: Bun, OpenCode, rustup, uv, Deno, pnpm, nvm (pinned version), and Homebrew.
50 or more blank lines with other text after them get a C too. Read what's down there.
Files over 200 KB used to be skipped. Now we scan the first 200 KB and say so in the reasons. We didn't read the whole file, so the grade can't be better than a C.
Small deductions
No license, abandoned for 12 months or more, or a brand-new account.
A A
No problem found. The scan flagged nothing in the file. A small deduction, like no license, can still apply.
B B
A few small flags. Read the reasons before you install.
What every grade means for you
Every grade comes from an automated scan. It shows what the scan found, and it can miss things. We don't vouch for any skill.
Read the reasons on the skill page. If the skill asks for access you would not give a stranger, skip it.
What a scan can't catch
We miss dormant triggers that wait for a date or a production host. We miss code fetched later from a URL we did not see on scan day. We miss new attack tricks we have not written rules for yet. A grade is a snapshot of the public file at scan time.
Check it yourself
Before you install:
- Read any scripts the skill ships.
- Note every URL it fetches.
- Check hooks and allowed-tools.
- Open .mcp.json if it has one.
- Look for hidden text. Hidden instructions in a SKILL.md shows how.
- Read any AGENTS.md or CLAUDE.md you didn't write. Malicious AGENTS.md shows why.
- Or put the skill's GitHub link into /check/ and compare.
Other tools
You can also try NVIDIA SkillSpector, Cisco skill-scanner, or Snyk Agent Scan. If a skill matters, get more than one look.
Report a skill
Each skill page has a "report this skill" link. Use it if a grade looks wrong, or if something malicious slipped through. We will say what we can fix and what we cannot.
Why this exists
Public skill registries grew with almost no vetting. Liu et al., 2026 found 157 malicious skills out of 98,380 on registries. In that same study, 84.2% of the vulnerabilities in those confirmed malicious skills sat in SKILL.md text, not in code. A separate Snyk report on 3,984 skills from clawhub.ai and skills.sh confirmed 76 malicious payloads (Snyk, 2026). CheckSkills gives you a second look before you install a file from the internet.
Short FAQ
How do I check a Claude Code skill before I install it?
Look it up here. Or put a GitHub link to the file into /check/ to get a grade. Read the grade, the reasons, and the file itself. Public registries have shipped malicious skills, so don't skip the reading.
How do I check Cursor rules before I use them?
Same as a skill. Read the file and run its GitHub link through /check/. Hidden text in a rules file can steer an agent too.
Does CheckSkills run the skill?
No. We read the public text. We do not execute it.
When do you grade a file again?
The crawler keeps searching GitHub. When it finds a listed file has changed, it grades it again. Skill pages show the last scan time.
Does a person review each skill?
No. It's an automated read of a public file.
What does an F mean?
The scan found remote script fetch-and-run, or secrets sent out. Do not install until you understand that behavior.
What should I do with a C?
Read the reasons. Hardcoded keys, sudo, chmod 777, or writes outside the project fired. Decide if that access is worth it.
Does an A mean I can install with my eyes closed?
No. Read the skill. Know what access you are giving.
Who pays for this?
Sponsors. The grades are not for sale.