I Scanned 40 Public Agent Skills Before Installation. Here’s What the Scorecard Found

Описание и применение

Разработчики получили инструмент SkillPreflight, позволяющий оценивать безопасность и качество навыков агента до установки, выявляя проблемы с безопасностью, документацией и токенами.

Задача

Developers need a way to assess the safety and quality of agent skills before installing them, as package ecosystems face trust issues.

Результат

All 40 scanned skills passed the static analysis; average score 80.8/100, median 85.5/100. Two skills required high-risk review. Token usage varied widely, with median 840.5 tokens and 90th percentile 2,699 tokens. Reliability and maintainability scored lowest, highlighting gaps in documentation and tests.

Рабочий процесс

• 1. Identify public skills via GitHub search queries for SKILL.md.
• 2. Pin each skill to a specific commit.
• 3. Run SkillPreflight 0.4.0 with default rules on the frozen sample.
• 4. Review the generated JSON/CSV benchmark data.
• 5. Use the scorecard to decide whether to install or request improvements.

Доказательства

All 40 selected skills scanned successfully.

Источник

The grade distribution was: A 1, B 29, C 5, D 3, F 2.

Источник

SkillPreflight therefore does not claim that an A grade proves safety.

Источник