Agent Skill Trust Check
Before you install a third-party agent skill from OpenClaw, an MCP bundle, or a GitHub SKILL.md, run this static analyzer to catch red flags. It scans the description text for risky patterns like shell execution, credential access, remote webhooks, and prompt injection signals, then lists missing provenance details like license or uninstall steps. The marketplace-safe stdin runner needs zero filesystem or network permissions, so it can run in sandboxed environments. It won't execute anything or guarantee runtime safety, but it gives you a structured pre-install checklist before you hand filesystem or API access to an untrusted package.
- GitHub stars
- 352
- last updated
- Jun 11, 2026
Install
$ npx -y skills add aiskillstore/marketplace --skill agent-skill-trust-check --agent claude-codeInstalls into .claude/skills of the current project.
Files
Agent Skill Trust Check
Use this skill before installing a third-party agent skill, SKILL.md package, MCP-linked skill, or marketplace listing.
What This Skill Does
- Reads a public or local skill description before install.
- Flags patterns that deserve review: shell execution, destructive commands, secrets, wallet/payment actions, network output, persistence, and prompt-boundary issues.
- Separates basic provenance signals from risky behavior signals.
- Produces a patch order that a maintainer can resolve before the skill is trusted.
When To Use
Use this when an agent is about to install or recommend a skill from:
- OpenClaw, Hermes, or ClawHub-style marketplaces.
- Claude Code, Codex, Cursor, Windsurf, or Gemini skill directories.
- MCP-linked skill bundles.
- GitHub repositories that include a
SKILL.md, tool manifest, or install script.
Run From The Public Repo
git clone https://github.com/TateLyman/agent-skill-trust-check.git
cd agent-skill-trust-check
npm run check
node bin/agent-skill-trust-check.js ./SKILL.md
Marketplace-safe stdin mode:
node bin/agent-skill-trust-check-stdin.js < ./SKILL.md
For JSON output:
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/aiskillstore/marketplace
- Category
- AI & Agent Building
- First seen
- Jun 11, 2026
More from aiskillstore/marketplace
All 37- Alibaba Java Coding Guidelines Skill
- Diasporic Intelligence
- Example Skill
- Find Outlook Emails
- Manage Linkedin Network
- Network And Relationship Manager
- Organize Google Contacts
- Schedule With Google Calendar
- Schedule With Outlook
- Skill Creator1.1K
- Frontend Design255
- Xlsx238
- Webapp Testing235
- Pptx230
- Docx225
- Canvas Design203
- Doc Coauthoring202
- Agent Development199
- Skill Development197
- Mcp Builder196
- Algorithmic Art193
- Skill Installer191
- Hook Development188
- Command Development186
Recommended
More AI & Agent Building
mcp-buildercomposiohq/awesome-claude-pluginsGuide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when b0skills.sh installs
agent-team-managercountbot-ai/countbot多智能体团队管理。创建、查看、修改、删除 CountBot 的多智能体团队，管理团队成员（角色）和团队级自定义模型配置。当用户要新建 Pipeline/Graph/Council 团队、调整成员分工、修改依赖关系、开关技能系统、设置团队专属模型时使用。0skills.sh installs
update-cite-countkimtth/awesome-azure-openai-llmGuidelines for updating citation counts for papers in the section files using the `update_citation_counts.py` tool. USE FOR: Updating citation counts for papers0skills.sh installs
dive-into-langgraphluochang212/dive-into-langgraphA comprehensive guide and reference for building agents using LangGraph 1.0, including ReAct agents, state graphs, and tool integrations.0skills.sh installs
ppt-agentsunbigfly/ppt-agent-skills专业 PPT 演示文稿全流程 AI 生成助手。模拟顶级 PPT 设计公司的完整工作流（需求调研到资料搜集到大纲策划到策划稿到设计稿），输出高质量 HTML 格式演示文稿。当用户提到制作 PPT、做演示文稿、做 slides、做幻灯片、做汇报材料、做培训课件、做路演 deck、做产品介绍页面时触发此技能。即使用户只说"帮0skills.sh installs
entra-agent-idmicrosoft/azure-skillsProvision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token e428.8Kskills.sh installs