What Each TrustedSkills Badge Actually Means

Installing a skill isn't like installing a browser extension where the worst case is an annoying ad. A skill runs with whatever access you have given your agent - your files, your API keys, your shell. So it matters what a badge is actually claiming. Here is exactly what each one asserts, and what none of them do.

What TrustedSkills does and doesn't do

TrustedSkills is an index. We crawl public sources and record where each skill came from, who publishes it, what it declares it needs, and how to install it on your platform. That is the product.

What we do not do: we do not read skill code, we do not run it, we do not commission audits, and we do not operate a volunteer review programme. An earlier version of this page claimed several of those things. They were not true, and they have been removed.

The badges

Official

The publishing account matches a GitHub organisation we recognise as the vendor behind the underlying product - Anthropic's own skills, Stripe's own skills, and so on. The match is against a maintained allowlist of organisation names.

What it tells you: the skill almost certainly comes from the company whose product it wraps, rather than from someone imitating them.

What it doesn't tell you: anything about the code. Vendors ship bugs and over-broad permissions too.

Featured

A small hand-picked set we think are a reasonable first thing to try on a new setup. It is an editorial opinion about usefulness.

What it doesn't tell you: anything about security. It is a recommendation, not a review.

Pinned

We recorded a specific commit hash for the skill and stored a snapshot of the repository at that commit. Installing fetches the snapshot, not whatever the repository holds today.

What it tells you: the code cannot change under you after the fact. If you audit it once, that audit stays valid for that pinned version. This is real protection against a maintainer - or whoever takes over their account - pushing a malicious update to a package you already trust.

What it doesn't tell you: whether the pinned code was ever any good. We pinned it; we didn't read it.

Listed

The default, and the overwhelming majority of the index. We found the skill on a public source and recorded its metadata. Installing resolves against the live repository, so you get whatever is there when you run the command.

Unverified

In the index, but we hold nothing beyond the bare listing - no matched publisher, no pinned commit. Treat it as a complete unknown.

At a glance

The "code read by a human" column is all No. That is the honest state of this registry today, and printing it is more use to you than a badge implying otherwise.

How to check a skill yourself

Since nobody else has, here is what to actually look at. It takes about five minutes and catches most of what matters.

1. Open the repository linked from the skill's page. Check it exists, has real history, and isn't a single drive-by commit.
2. Read the manifest. SKILL.md declares the environment variables and binaries the skill wants. If a Markdown formatter asks for AWS_SECRET_ACCESS_KEY, stop there.
3. Grep for network calls. Look for fetch(, axios, http.request, curl. Every destination host should be one the skill's stated purpose explains.
4. Grep for dynamic execution. eval(, new Function(, child_process, exec(, and base64 blobs that get decoded and run. Legitimate skills rarely need these, and they are how a payload hides.
5. Check the install script. A postinstall hook, or anything piping curl into a shell, runs before you have looked at anything.
6. Check file access. Reads of ~/.ssh, ~/.aws, .env, browser profiles or credential stores are almost never justified.

Reporting a problem

If you find a skill in this index doing something it shouldn't, open a report on GitHub. We read every report and can delist a skill from the index. We don't promise a response time. If it also ships as an npm package, report that separately to npm at [email protected] - delisting here does not remove it from npm.

Frequently asked questions

Does any badge mean the skill has been security reviewed?

No. No badge means a person read the code. One badge does mean a machine did: Checked is a static scan of the skill's files at a named commit, looking for credential reads, undeclared network calls, encoded payloads that get executed and pipe-to-shell installers. Every result is printed on the skill's page — see what the automated safety pass covers. The other badges describe provenance: who published the skill, and whether the install is pinned to a fixed commit.

Is it safe to install a Listed skill?

It carries exactly as much risk as installing any unreviewed code from the internet, because that is what it is. Read the repository first: check the declared environment variables, any network calls, and anything that executes a string.

What is the practical difference between Pinned and everything else?

A pinned skill installs from a snapshot we stored at a specific commit, so it cannot change after you have looked at it. Everything else resolves against the live repository, which means a later push changes what you install.

How do I get a badge for my skill?

You can't apply. Official is assigned automatically when your publishing org matches the vendor allowlist, Pinned when the registry records and stores a commit for your skill, and Featured is an editorial pick.

How do I report a malicious skill?

Open an issue in the TrustedSkills registry on GitHub and mark it as a security report. Report any npm package separately to [email protected].