I Scanned 40 Public Agent Skills Before Installation. Here’s What the Scorecard Found

Description and use

Developers now have SkillPreflight, a static scorecard that evaluates agent skills before installation, highlighting security, documentation, and token usage issues.

Problem

Developers need a way to assess the safety and quality of agent skills before installing them, as package ecosystems face trust issues.

Outcome

All 40 scanned skills passed the static analysis; average score 80.8/100, median 85.5/100. Two skills required high-risk review. Token usage varied widely, with median 840.5 tokens and 90th percentile 2,699 tokens. Reliability and maintainability scored lowest, highlighting gaps in documentation and tests.

Workflow

• 1. Identify public skills via GitHub search queries for SKILL.md.
• 2. Pin each skill to a specific commit.
• 3. Run SkillPreflight 0.4.0 with default rules on the frozen sample.
• 4. Review the generated JSON/CSV benchmark data.
• 5. Use the scorecard to decide whether to install or request improvements.

Evidence

All 40 selected skills scanned successfully.

Source

The grade distribution was: A 1, B 29, C 5, D 3, F 2.

Source

SkillPreflight therefore does not claim that an A grade proves safety.

Source