Every week someone on LinkedIn offers me a skill for my agent. A folder with a SKILL.md, a few reference files, sometimes a script. You drop it into your agent and it gets whatever your agent can reach: your shell, your files, the tokens in your environment.

So I wanted to know what an individual developer can use today to check a skill before installing it. I looked at what is out there and then ran the two strongest free options on the 22 skills in my own workspace.

What is available today

Most of what you will find falls into three buckets.

Tools you can run locally on any folder: NVIDIA SkillSpector and Cisco AI Defense skill-scanner. Both are Apache-2.0, both work without an account, and both have an optional LLM pass you can switch on with your own key.

Hosted or account-based tools: Snyk Agent Scan (the CLI that used to be Invariant's mcp-scan) needs a free Snyk token and sends skill content to Snyk for analysis. Its web cousin, Snyk Skill Inspector, takes a folder or URL. There are a few others, such as Permiso SandyClaw, the only one I found that runs the skill in a sandbox, behind a sign-up.

Marketplace verdicts you can read but not run on your own files: the security tab on skills.sh (Gen, Socket and Snyk audits) and the Skill Card on ClawHub (VirusTotal plus SkillSpector).

Enterprise scanners exist too, including the one inside Claude Enterprise plans. None of them is something you or I can point at a random folder this afternoon.

Running both scanners

I installed both with uv:

uv tool install git+https://github.com/NVIDIA/skillspector.git uv tool install cisco-ai-skill-scanner

Then I scanned the whole folder, static analysis only. No LLM, no API keys, nothing left the machine.

skillspector scan ./skills/ --recursive --no-llm --format json --output skillspector.json skill-scanner scan-all ./skills/ --recursive --use-behavioral --lenient --format json --output cisco.json

Versions: SkillSpector 2.12.0 and skill-scanner 2.3.2. The --lenient flag lets Cisco's scanner accept folders that do not follow the Agent Skills spec to the letter, which a few of mine do not.

What SkillSpector said

The overall verdict was DO_NOT_INSTALL, with a maximum score of 100 out of 100.

It raised 27 findings in 8 of the 22 skills: 6 critical, 8 high and 13 medium. I read every one of them.

The critical ones all came from a single skill for ad creative, and all six pointed at the same word: "arsenic". The skill contains an example ad for a protein powder brand that says its batches are tested for heavy metals. SkillSpector's harmful-content pattern matched the word and scored the skill 100.

The high ones followed the same logic. "Always respond" in a cold email framework was flagged as an anti-refusal instruction. "Do not judge a post before day 10" in my LinkedIn skill was flagged as an instruction to suppress warnings. "Access token" in notes about headless CMS previews became credential access. A skill description that says "use the video-edit skill" was flagged as self-modification.

None of those is a threat. They are keyword rules reading marketing prose without context.

What Cisco said

Cisco's scanner marked 20 of the 22 skills safe. It raised 33 findings, and 25 of them were informational: no license declared in the skill manifest, which is expected for private skills.

The two high findings were about analyzability. Two of my skills ship a packaged .skill file next to the source, and Cisco cannot open it, so it marks the skill as hard to analyze. SkillSpector did unpack those files and scanned their contents.

The medium ones: a curl call to the public Hacker News search API in an example, flagged as a tainted data flow, and a link to replicate.com flagged as a suspicious free domain.

The one real finding

Both tools agreed on something worth fixing. Two of my skills tell the agent to run npx with an unpinned package. If that package is ever compromised upstream, the next run pulls the malicious version without anyone noticing. SkillSpector files this as "MCP rug pull". The fix is one line: pin the version.

So, two scanners, 60 findings combined, one actionable item. That ratio is the main thing I learned.

What the scanners miss

My results are about false positives. The other direction is worse.

In June, Trail of Bits wrote four deliberately malicious skills and ran them through the scanners people rely on. Three took under an hour to build. One hid its payload behind 100,000 blank lines, and ClawHub's scanner truncated the file before reaching it. Another shipped a clean Python helper next to a compiled .pyc file that read environment variables, and Cisco's skill-scanner returned safe with zero findings because its static checks skipped .pyc files. A third hid a script inside a .docx, which is a zip archive. The fourth disguised a switch to an attacker-controlled npm registry as corporate configuration, and the LLM judge rated it low risk. Two of them also passed all three auditors on skills.sh.

Their write-up is worth reading in full: The sorry state of skill distribution.

A scanner pass tells you the obvious patterns are missing. It tells you nothing about what the skill downloads at runtime or what a compiled file does once your agent loads it.

Five checks before I install a skill

This is what I do now with anything someone sends me.

  1. Read every file. Open SKILL.md and list the whole folder. Anything compiled, zipped or tucked inside an Office document gets deleted or explained. This is the step that catches the .pyc trick, because you cannot miss it when you list the folder.
  2. Search for what it downloads. curl, wget, npx, pip install, git clone. Every package needs a pinned version. Two of my own skills failed this one.
  3. Run SkillSpector and Cisco locally. Different rule sets catch different things. Read the findings, ignore the headline score.
  4. Check the marketplace verdict if the skill comes from skills.sh or ClawHub. It costs nothing and covers the published version.
  5. First run in a throwaway environment with no tokens loaded. A container or a fresh user account is enough.

If you want a second pass with more context, both scanners have an LLM mode. SkillSpector can use a local model through Ollama or your existing Claude CLI login, so the skill still does not leave your machine. I have not run that mode yet, so I cannot tell you how much of the noise above it removes.

What do you check before installing a skill? I would like to know what I am missing.