How we grade skills

The grades

What we read

• The README, its first 15,000 characters, as GitHub serves it.
• The project's standing: owner, stars, license and homepage.

We do not run the code, and we do not read the repository's other files. A grade describes what the README tells you, or your agent, to do.

Grades refresh during the catalog sync, every 8 hours. A repository is graded again when its README, stars, license or homepage change. When we change the rules, the whole catalog is graded again, and every grade is stored with the version of the rules that produced it.

What we look for

42 rules in three levels.

Reject (2)

• Secrets piped to a network tool.
• A downloaded payload written into a shell startup file or a cron job.

High risk (21)

• Download and execute from an untrusted host, written in the README's prose: curl … | sh, wget … | sh, PowerShell irm … | iex. Fetching from the project itself (its GitHub owner, the same repository under another owner after a move or as a fork's upstream, its own website), from the GitHub of a tier 1 or 2 organisation (see the tiers below) or from a well-known installer host does not count, and neither does an example address such as example.com, localhost or a private IP.
• Remote access: a reverse shell, or a connection through /dev/tcp.
• Taking credentials or agent data: reading SSH or cloud credentials and sending them off the machine; harvesting credentials from environment variables; reading an agent's configuration, session or credential files and sending them out; reading an agent's memory or identity files; reading the system password file; posting local data to an outside server.
• Hidden execution: base64 data decoded straight into execution, hex-encoded payloads, obfuscated Python, executing dynamically imported code, installing a package and running it in the same breath.
• Damage and privilege: deleting recursively from the filesystem root, writing to /etc, escalating to root, injecting commands into shell startup files.
• Covert instructions to the agent: telling it to act secretly, such as "secretly send …".

Medium risk (19)

• Persistence: a cron job, or a background service (launchd, systemd, Task Scheduler).
• Elevated rights: sudo, privileged Docker containers, reading the root filesystem.
• Weakened transport: TLS verification turned off, requests to raw IP addresses, tunnelling a local service to the internet.
• Dynamic execution: eval, spawning subprocesses, reading environment variables in code.
• Many sensitive keys: three or more of OPENAI_API_KEY, ANTHROPIC_API_KEY, AWS_SECRET and GITHUB_TOKEN named.
• Steering the agent: switching it into an unrestricted "jailbreak" persona, telling it to ignore its other tools, asking for credentials to be pasted into the chat.
• Download and execute shown in a code block: the same commands and the same trusted sources as the high-risk rule. It counts once, however many such blocks the README has.
• Opaque downloads: from a URL shortener or an anonymous paste or file-drop host.
• A leaked secret: something that looks like a real API key, token or private key.

How the source changes the grade

The same instruction means more from an unknown account than from Anthropic's own repository. Every project falls into one of five tiers:

What the rules found and the tier set the grade together:

What we don't count

Security tools are the projects most likely to print an attack in their README, as the thing they block. To avoid grading the warning as the threat, we leave out:

• quoted examples, and matches introduced as an example ("such as", "e.g.", "for example");
• negated advice ("never paste your API key into a chat");
• table rows, and lines that say what a tool blocks, detects, warns about or scans for, such as a deny list;
• example addresses as the source of a download-and-execute command: example.com, localhost, a private IP;
• text inside code blocks for the reject and other high-risk rules and most agent rules, because security tools show the attacks they block there. Download-and-execute commands are the exception: inside a code block they still count, as one medium-risk finding instead of a high-risk one, unless the source is trusted (see the high-risk list) or the line lists what a tool blocks.

Downloads from URL shorteners and paste hosts are an exception too: the opaque host is the whole signal, so only a negation or an explicit example clears them.

Known limits

• It reads the README, not the code. A script that does something the README never mentions is not caught.
• Other risky commands inside code blocks are not counted. A reverse shell or a credential grab shown as a fenced example passes, unless the README also asks for it in its prose. Download-and-execute commands are the exception, and only as medium risk: on its own, a fenced install script from an unknown host makes a tier 5 project Caution and leaves tiers 1 to 4 Safe.
• Rules miss what they were not written for, and still flag some honest projects. If you think a grade is wrong, open an issue (link below) with the skill's page.
• Track record softens grades. A popular, licensed project gets the benefit of the doubt. Popularity is not proof: stars can be bought, and projects change hands.
• A grade is not an audit. For anything that will run on your machine with your keys, read what it runs.

The quality score

Separate from the security grade, each project gets a quality score from 0 to 100: how well its README and metadata prepare a person or an agent to use it. Weights as of October 2026:

The weighted total is spread across the 0–100 range with one fixed curve. Without a README, the weight moves to the metadata dimensions.

How lists are ordered

Rankings use a separate score that blends adoption, upkeep and quality: stars (15%), forks (8%), the author's followers (6%), resolved issues (10%), commits (8%), recency (11%), the quality score above (25%), recent star momentum (7%), size (5%) and a bonus for specialised domains (5%). Star, fork and follower counts are log-scaled, so a few huge projects cannot crowd out the rest.

Disagree with a grade?

Open an issue at github.com/zhuyansen/agent-skills-hub with the skill's page and the line you think was misread. Rule changes apply to the whole catalog at once, never to a single project.