A skill is a folder of instructions an agent will follow with your permissions. This scan reads every file in every skill folder in a repository and reports the patterns a skill should never need, with the file and line, so you can read it before it runs. It is the same scan behind the 1,743 listings here.
Use This Skill- uses: actions/checkout@v4
- uses: nodegenie/awesome-agent-skills/scan@main
with:
fail-on: flagFails the check when a skill folder contains a flag-level pattern, and shows the findings in the job summary. Set fail-on: review to be stricter, or none to report only.
Flags: downloads piped into a shell, destructive commands against the system, data sent to webhooks and request catchers, encoded code that is then executed. Review: rules-override phrasing, credential paths, sudo and broad permission changes, persistence, force-pushes. Every rule is explained on the safety page.
Across the directory today: 1,687 clear, 46 to review, 10 flagged, out of 1,743 skills.
Public repositories scan free, forever. Private repositories and organizations use a Team key, $29 a month per organization with fourteen days free and no card to start. The key also unlocks the connector for your team.
It is a static pattern match. It cannot run the skill or predict what a model will do with it, and it will miss what a determined author hides. Clear means none of the nine patterns appeared. Read the source, check the license, install into a project you can afford to reset.