What we check

Every skill here was checked for malicious code before it was listed, and the catalog keeps itself current. Here is exactly how.

How a skill gets listed

• Every day, an automated job searches GitHub — by topic, by keyword, and through the repos of trusted creators — for new skills. A repo qualifies if it is real, carries an open-source license, was pushed to in the last year, and actually contains a skill.
• Before listing, a scanner clones the repo and reads every file for known-dangerous patterns: install lines that pipe a download straight into a shell, code that reads credentials or SSH keys, and obfuscated or encoded code hiding what it does.
• Anything flagged in runnable code is quarantined — never listed, not even with a warning. An install command quoted in a README is noted, not treated as malice.

How it stays current

• Every listed skill is refreshed daily — stars, last push, description.
• When a skill’s code changes, it is re-scanned on the new code before it stays listed. Creators who ship a new version every week show up here the next day.
• Quarantined repos are re-scanned too; one that comes up clean on its current code comes back automatically.
• The date of each repo’s latest scan is in the public catalog data (checked.date).

What this does and doesn’t cover

The scan catches known malicious patterns; it is not a line-by-line review and not a guarantee that a skill will work for you. Everything here is provided as-is. The Skillproof skill reads a skill’s current source before it runs anything from it — and you should read anything before you run it too.

← Back to the catalog · The scanner’s source · The daily job’s source