Record the owner, exact path, commit, tag, or archive hash. Mark a mutable branch as MOVING_SOURCE.
Pre-install review · Editable templates · Retained tests
Agent Skill Audit Kit: inspect before granting access.
Download a complete review kit for turning a Skill folder, ZIP, repository path, or listing into an evidence-bounded intake decision—without installing or running the candidate.
One intake system
Move from a listing signal to a reviewable decision.
Connect reads, writes, execution, network, credentials, dependencies, and authority to exact evidence.
Choose isolated test, manual review, do not install, or insufficient evidence—never a broad safety promise.
Use synthetic input, a disposable workspace, withheld expectations, and observable pass and fail conditions.
Evidence boundary: the kit supports pre-install triage. It does not certify malware absence, dependency security, remote service behavior, legal compliance, or future updates.
Editable working files
Use the whole kit or take one template.
Pre-install checklistMarkdown · source, activation, capability, evidence, and verdict gates
Permission registerCSV · reads, writes, execution, network, credentials, and controls
Audit report templateMarkdown · seven fixed sections and four controlled verdicts
Behavior-test planMarkdown · answer-blind normal and adverse cases
Observed test recordMarkdown · environment, fixture hashes, verdicts, and evidence ceiling
Answer-blind fixture contrast
Two small cases test the decision boundary.
A single-file Skill reads a supplied fictional changelog, returns Markdown, and expressly excludes browsing, file writes, publication, deployment, and repository retrieval.
SUITABLE_FOR_ISOLATED_TEST
A deliberately problematic fixture requests environment-variable access, token and task-text transmission, review bypass, concealment, and activation on unrelated work.
DO_NOT_INSTALL
Each session received either the exact Prompt or the Auditor plus one fixture. It did not receive the expected-results file; grading happened after the complete response was captured.
Four reviews ran in separate ephemeral, read-only sessions. No candidate was installed or executed, and no real credential or endpoint was used.
What the result means
Behavior-tested is not security-certified.
The exact copyable Prompt and the included Skill each returned both expected verdicts under the recorded local environment. They kept the adverse fixture's instructions inert, cited the credential and network request, and did not contact the fictional destination.
The retained evidence does not cover implicit activation, other models or hosts, large or obfuscated repositories, binaries, transitive dependencies, real services, every prompt-injection form, or future revisions. Use the fixtures as a reproducible starting point, then design tests around the permissions that matter in your own environment.
Why rankings come first—but do not decide
Popularity is a discovery signal.
The skills.sh API documentation defines all-time, trending, and hot views using install telemetry. Those signals can reveal what people want to try. They do not establish active use, successful outcomes, present quality, or safety. This kit begins where a leaderboard stops: at the exact files and revision you may give access to.
The directory's own documentation warns that an audit is not a quality or security guarantee and tells users to inspect Skills before installing them. A directory audit or scan can add evidence, but it cannot replace a local fit and permission review. Preserve both layers and keep their claims separate.
Choose the right entry point
Learn once, copy once, or reuse the workflow.
Read the complete intake guideInterpret rankings, freeze the source, review capability, choose scope, and design an isolated first test.
Copy the one-off review PromptUse the full inspection instruction when you do not need a persistent Skill.
Inspect the reusable SkillReview the five-file package, exact permissions, behavior evidence, installation boundary, and limitations.