Agent Skill Checker

An Agent Skill is a folder with a SKILL.md file: a short YAML header with a name and a description, then instructions in Markdown, often with scripts and reference files beside it. Anthropic published the format as an open standard in December 2025, and many coding agents now load skills from the same folders.

The description is how the agent decides to use a skill, so it sits in the agent’s context in every session. Once a skill is picked, the agent follows its instructions and runs its scripts with your permissions: your files, your shell, your keys. That is what makes skills useful, and why a bad one is dangerous. Anthropic’s own advice is to use skills only from sources you trust and to audit everything bundled with one before you use it.

The scan reads SKILL.md and every text file in the skill, line by line. It looks for the things malicious skills have been found doing: downloading a script and piping it into a shell, reading SSH keys, cloud credentials, .env files or the keychain, posting data to another server, hiding code in base64 or escape codes, deleting files or force-pushing over history, adding cron jobs or lines to your shell startup files, and switching off permission prompts.

It also looks at what only the agent sees. HTML comments and invisible Unicode (tag characters, direction controls, zero-width characters) don’t show on GitHub or in a marketplace page, but a model reads them. When a skill hides text in tag characters, the checker decodes it so you can read it too. Instructions to ignore earlier rules, to keep something from you or not to ask before acting are flagged as prompt injection.

In Claude Code, a line like !`command` in SKILL.md runs that command when the skill loads, before the model reads anything, and allowed-tools pre-approves tools for the skill without a prompt. Both are flagged, with blanket grants such as plain Bash rated high.

This is pattern matching on text. It never runs anything, so it can’t see what a script downloads at run time or what a URL will serve tomorrow. Plain-English instructions can lead an agent to do harm in words no pattern catches, and a determined author can write code that slips past any fixed list. Snyk makes the same point about regex-based skill scanners.

So read the verdict the right way round. Findings are reasons to look closely, with the line and an explanation for each. "No red flags found" means none of the checks matched, not that the skill is safe. Read its scripts, prefer skills from authors you can identify, and install from a pinned version rather than whatever is newest.

The spec checks follow the Agent Skills specification and its reference validator, skills-ref: SKILL.md must start with YAML frontmatter; only name, description, license, compatibility, metadata and allowed-tools are allowed; name is 1 to 64 lowercase letters, digits and hyphens with no hyphen at either end and no two in a row, and matches the folder; description is 1 to 1,024 characters; compatibility is up to 500.

Some agents add their own rules, shown as warnings: Anthropic rejects XML tags in name and description and reserves the words "anthropic" and "claude" in names, and Claude Code reads extra fields (disable-model-invocation, context, hooks and more) that other agents reject. Tips follow the authoring advice: say what the skill does and when to use it, in the third person; keep SKILL.md under 500 lines; link reference files directly from SKILL.md.