Directory

A skill is a folder of Markdown that can run code

Agent Skills arrive through a channel with no dependency review, no lockfile and no software-composition scanning — and some of them bundle scripts that execute with your engineer's full permissions. Here is how to review one, and profiles of the skills published so far.

what this directory is

Profiles compiled by hand from each publisher's documentation, describing what a skill does and what it executes. Claims are held at the level the publisher states — we do not assert specific file contents or permission lists, because those change and guessing them would be fabrication dressed as detail.

No Vincosha Assay scan verdicts appear here. Every entry says so plainly. 6 of the 8 skills below bundle executable code, which is the single most important review signal and is called out on each page.

How to review an Agent Skill

A skill is a directory containing a `SKILL.md` — YAML frontmatter with a name and description, then Markdown instructions — and optionally reference files and executable scripts. That format is why skills are easy to share and easy to under-review: the thing you are asked to approve looks like documentation.

Two distinct risks follow from the same folder, and conflating them is what makes skill review ineffective.

  • The instructions are untrusted input that behaves like trusted instruction

    An agent treats a loaded skill as guidance from its operator. A long skill body can contain a line nobody read — relax a check, skip a review step, prefer a particular endpoint — and it will be followed in every session the skill triggers in. The review question is not 'is this well written' but 'would I sign off on every imperative sentence in here'.

  • Bundled scripts are arbitrary code with no dependency review

    Where a skill ships scripts, those run with the permissions of the engineer running the agent. Nothing about a folder of Markdown looks like a dependency, so no software-composition analysis covers it, no lockfile pins it, and no scanner flags it. This is the half that turns a bad skill into an incident.

The controls that work are the ones dependencies already have, applied to a new artifact class: a known publisher, an exact pinned version rather than a moving branch, a diff on update instead of a silent pull, a scan before distribution, and a record of which machines loaded which version. None of that is novel — it is simply not yet standard here, because installing a skill does not feel like adding a dependency.

The one control specific to this artifact class is context discipline. Skills use progressive disclosure: only the name and description sit in context until the skill triggers. That is what lets a team install many skills without exhausting the context window, and it means a skill with a vague description either never fires or fires constantly — both of which are review findings.

8 / 8 skills

Frequently asked

What is the difference between a skill and an MCP server?
A skill teaches an agent a procedure using capabilities it already has. An MCP server gives it a new capability — access to a system it otherwise could not reach. Skills are knowledge; servers are access. Most real workflows use both, and they need different reviews.
Do all Agent Skills contain executable code?
No, and the difference matters more than anything else in a review. Many skills are purely instructions, with no scripts and no privilege requirement — genuinely low risk. Others bundle code for deterministic work like document manipulation, and that code runs with the invoking user's permissions. Each page here states which.
Why don't dependency scanners catch malicious skills?
Because a skill is not a package. Scanners read package manifests and lockfiles; a skill is a directory of Markdown with optional scripts, declared nowhere. Covering it needs an inventory that enumerates instruction artifacts explicitly — an AI-BOM rather than an SBOM.
How should a team distribute skills safely?
Centrally, versioned, and pinned. One source of record, exact versions with content hashes, a scan before distribution, a diff on change, and the ability to revoke a version and have it propagate. Copying folders between laptops is how a rug pull becomes possible.

Related

Distribute skills the way you distribute dependencies

Vincosha Registry is one versioned, signed source for the skills, rules, hooks and connectors every AI surface loads — with a lockfile, so the version you reviewed is provably the version installed.

Start freeRead the docs