skill-safety-reviewlisted

# Review a skill before you install it Snyk's ToxicSkills audit of 3,984 skills (Feb 2026) found 36.8% with at least one security flaw, 13.4% critical, and 76 carrying confirmed malicious payloads. The documented patterns were credential harvesting from the developer's shell, silent environment-variable exfiltration, and instructions injected into the agent's own context. The attack does not exploit a bug. It uses the agent exactly as designed, which is why nothing in the platform stops it. ## The refusal **A clean scan is not a safety verdict, and this skill must never issue one.** Report what was found and what could not be checked. "No flagged patterns" means no known text patterns matched, nothing more. Never execute, install, or run the skill under review. Reading is the whole job. ## Procedure 1. Run the scanner. It is read-only and pattern-matches text. ```bash node skills/skill-safety-review/scan.ts path/to/SKILL.md ``` Exit code 2 means at least one critical finding. 2. **Read every critical finding in context.** Several rules fire legitimately in build tooling. `child_process` in a test-runner skill is expected. `child_process` in a skill that formats dates is not. The judgement is what the tool cannot do. 3. **Check what the scanner does not see.** Bundled scripts, referenced files, anything fetched at run time, and dependencies. Read those too, or say they were not read. 4. **Look at the source, not just the file.** Who publishes i