How entries are vetted
A skill runs with the same access as the agent that loads it. In NVIDIA's analysis of 31,132 public skills, 26% contained vulnerabilities and 5% showed likely malicious intent. So nothing is listed on reputation alone.
Two checks, recorded separately
The scan is automated. Each skill or MCP server goes through SkillSpector, which runs 71 checks for prompt injection, data exfiltration, privilege escalation and supply-chain risk, and scores the result from 0 to 100. Its output is recorded as-is.
The review is a person reading the source behind every serious finding. It decides the verdict. Scanners flag patterns, not intent: a skill that legitimately runs Python to edit a spreadsheet can score 100. The score tells you where to look; the review tells you what was there.
Review verdicts
- Reviewed — safe to install
- The source matches what it claims to do, and every serious finding was explained.
- Reviewed — install with care
- Sensitive behavior exists — network calls, file writes, credentials — but it is documented, necessary and under your control. The entry says what it is.
- Review pending
- Listed, but no one has read the flagged source yet. Check the scan before installing.
Anything reviewed as reject — hidden instructions, unexplained data leaving the machine, obfuscated code — is not listed at all.
What it can touch
Safe to install and safe to point at your accounts are different questions. Every entry says which of these it is, so you can filter out anything that can change your data or spend your money.
- Guidance only
- Nothing runs and nothing connects: a prompt, a spec or a model choice.
- Runs on your machine
- Works on local files and folders; no access to your online accounts.
- Reads your accounts
- Connects to a service or data source and changes nothing.
- Changes things, asks first
- Can create or change records, and confirms each write with you.
- Changes things freely
- Can create, change or delete in your accounts without asking each time.
- Can move money
- Can create charges, payments, refunds or transfers.
Trust tiers
- Official
- Published by the platform or the maker of the thing itself.
- Vetted
- Third-party; scanned and reviewed as safe to install.
- Community
- Third-party; works, with sensitive behavior documented on the page.
- Unreviewed
- Listed for discovery; not vetted yet.
Before you install anything
- Pin versions. An unpinned install runs whatever was published most recently.
- Install only into the agent you'll use it with. Some installers add themselves to every agent they find.
- Rescan after upgrading. A review covers the commit it names, not later ones.
- Keep API keys out of your repos: in the tool's own login, your system keychain, or your host's environment variables.