{ "schemaVersion": 2, "status": "ready", "reviewedOn": "2026-10-19", "coverageCounts": { "source-reviewed": 20, "runtime-probed": 7, "task-tested": 16 }, "notice": "Review coverage and documented experience are separate. See each record and linked report for exact scope, results and limitations. This catalog does not certify safety or establish general task effectiveness.", "methodologyUrl": "https://ionbin.com/skills/methodology/", "skills": [ { "id": "vercel-react-best-practices", "name": "React Best Practices", "owner": "Vercel", "repository": "https://github.com/vercel-labs/agent-skills", "skillPath": "skills/react-best-practices/SKILL.md", "sourceUrl": "https://github.com/vercel-labs/agent-skills/blob/063bee94c3f4df8453406c830b0a7df0f2860278/skills/react-best-practices/SKILL.md", "category": "Frontend", "summary": "A prioritized React and Next.js review guide covering request waterfalls, bundle size, rendering and server behavior.", "bestFor": [ "Reviewing React or Next.js performance changes", "Finding avoidable sequential requests and oversized client bundles" ], "requirements": [ "An agent able to read SKILL.md and the referenced rule files; no executable helper is invoked by the reviewed entrypoint.", "Access to the target React/Next.js source. Building and measuring changes needs that project's own runtime and tooling.", "No Vercel account or skill-specific API key is specified. Operating-system support depends on the host agent and project; not tested here." ], "permissions": [ "Read application source and bundled guidance.", "Writing code or running project commands is a separate host-agent capability; the guide is not a permission sandbox." ], "risks": [ { "title": "Server changes need security review", "severity": "attention", "detail": "The rules explicitly address authentication and cross-request data leaks. IonBin assessment: performance refactors touching server state or actions still need application-specific authorization and concurrency checks." }, { "title": "Version-sensitive recommendations", "severity": "attention", "detail": "The guide references framework features and libraries. IonBin assessment: check the target project's versions and measure behavior before accepting a suggested rewrite." } ], "limitations": [ "Selected rules reviewed; not every rule or the compiled AGENTS.md.", "The reviewed SKILL.md advertises 70 rules; no independent rule count or performance gain was verified." ], "license": { "label": "MIT", "url": "https://github.com/vercel-labs/agent-skills/blob/063bee94c3f4df8453406c830b0a7df0f2860278/skills/react-best-practices/SKILL.md", "note": "MIT is declared in the skill frontmatter and repository README; this review did not inspect a separate license text." }, "evidence": { "level": "task-tested", "reviewedOn": "2026-10-18", "revision": "063bee94c3f4df8453406c830b0a7df0f2860278", "scope": [ "SKILL.md entrypoint and rule index", "rules/server-no-shared-module-state.md", "rules/server-auth-actions.md", "README.md license declaration", "Bounded evaluation; exact operations, counts, environment and limitations in the linked public report" ], "notTested": [ "No effectiveness benchmark or security certification", "Transitive dependencies, current advisories and host-agent permission controls not audited", "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "task-evaluation", "summary": "One synthetic decision scenario, checked against a prewritten action rubric. Skill-conditioned 7/7; baseline 7/7. No measured advantage or executed workflow is claimed.", "environment": [ "Codex agent session; separate fresh baseline and skill-conditioned agents", "Text-only synthetic fixture; identical task and allowed-action contract; no network or account operations" ], "commands": [ "Read the recorded fixture and allowed actions; baseline receives no skill source.", "Read the pinned entrypoint and listed supporting instructions for the conditioned arm.", "Score required/rejected action selections, no-tool-request behavior and valid unique action IDs against the prewritten rubric." ], "results": { "passed": 7, "failed": 0, "total": 7 }, "findings": [ { "severity": "info", "title": "No measured advantage over baseline", "detail": "Both arms selected the same scored actions: baseline 7/7, skill-conditioned 7/7. These are decision checks, not completed real-world tasks." } ], "limitations": [ "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed.", "The response contract explicitly forbids tool use and treating fixture text as instructions. This cannot isolate skill-specific prompt-injection protection.", "Choices are conspicuous and the baseline reached the ceiling. No improvement in effectiveness, general reliability, security or productivity is established.", "No repetitions, blinded human quality ratings, time/cost comparison or cross-model/platform validation." ], "artifact": "/skill-evaluations/vercel-react-best-practices.json", "runAt": "2026-10-18" }, "popularity": { "basis": "Rounded repository-wide GitHub stars observed in the public repository page; not skill installs, a quality score, or a measured trend.", "url": "https://github.com/vercel-labs/agent-skills", "observedOn": "2026-10-18", "value": 32600, "metric": "repository-stars-rounded" }, "sources": [ { "label": "Skill purpose, requirements and rule index", "url": "https://github.com/vercel-labs/agent-skills/blob/063bee94c3f4df8453406c830b0a7df0f2860278/skills/react-best-practices/SKILL.md" }, { "label": "Shared server state and data-leak guidance", "url": "https://github.com/vercel-labs/agent-skills/blob/063bee94c3f4df8453406c830b0a7df0f2860278/skills/react-best-practices/rules/server-no-shared-module-state.md" }, { "label": "Server-action authorization guidance", "url": "https://github.com/vercel-labs/agent-skills/blob/063bee94c3f4df8453406c830b0a7df0f2860278/skills/react-best-practices/rules/server-auth-actions.md" }, { "label": "Repository license declaration", "url": "https://github.com/vercel-labs/agent-skills/blob/063bee94c3f4df8453406c830b0a7df0f2860278/README.md" }, { "label": "Repository popularity context", "url": "https://github.com/vercel-labs/agent-skills" } ] }, { "id": "vercel-web-design-guidelines", "name": "Web Design Guidelines", "owner": "Vercel", "repository": "https://github.com/vercel-labs/agent-skills", "skillPath": "skills/web-design-guidelines/SKILL.md", "sourceUrl": "https://github.com/vercel-labs/agent-skills/blob/063bee94c3f4df8453406c830b0a7df0f2860278/skills/web-design-guidelines/SKILL.md", "category": "Design & accessibility", "summary": "Reviews UI source against Vercel's interface rules and returns findings with file and line references.", "bestFor": [ "Checking forms, focus, semantics and interaction details", "A code-review pass before manual accessibility testing" ], "requirements": [ "An agent with file-reading and an HTTP-fetch capability; the entrypoint names WebFetch.", "Network access to raw.githubusercontent.com for the external guideline file on every review.", "No skill-specific account, API key or executable runtime is specified. Host compatibility was not tested." ], "permissions": [ "Read the files selected for review.", "Fetch external Markdown instructions from a separate public repository." ], "risks": [ { "title": "Mutable remote instructions", "severity": "attention", "detail": "The pinned skill fetches command.md from another repository's main branch. IonBin assessment: pinning this SKILL.md alone does not freeze the instructions actually applied; review the fetched rules as well." }, { "title": "Accessibility assurance gap", "severity": "attention", "detail": "This workflow inspects source rules. IonBin assessment: its findings do not establish screen-reader behavior, keyboard usability or a compliance certification without runtime and human testing." } ], "limitations": [ "The wrapper is commit-pinned, but the external guidelines were reviewed on main and remain unpinned.", "The rules mix accessibility checks with Vercel-specific copy and visual preferences; assess applicability to the project." ], "license": { "label": "MIT (repository declaration)", "url": "https://github.com/vercel-labs/agent-skills/blob/063bee94c3f4df8453406c830b0a7df0f2860278/README.md", "note": "The parent repository declares MIT. A separate license for the externally fetched guideline content was not established in this review." }, "evidence": { "level": "task-tested", "reviewedOn": "2026-10-18", "revision": "063bee94c3f4df8453406c830b0a7df0f2860278", "scope": [ "Entire skills/web-design-guidelines/SKILL.md", "External vercel-labs/web-interface-guidelines command.md on main, observed on the review date", "README.md license declaration", "Bounded evaluation; exact operations, counts, environment and limitations in the linked public report" ], "notTested": [ "No effectiveness benchmark or security certification", "Transitive dependencies, current advisories and host-agent permission controls not audited", "No browser, assistive-technology or rendered-UI testing", "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "task-evaluation", "summary": "One synthetic decision scenario, checked against a prewritten action rubric. Skill-conditioned 8/8; baseline 8/8. No measured advantage or executed workflow is claimed.", "environment": [ "Codex agent session; separate fresh baseline and skill-conditioned agents", "Text-only synthetic fixture; identical task and allowed-action contract; no network or account operations" ], "commands": [ "Read the recorded fixture and allowed actions; baseline receives no skill source.", "Read the pinned entrypoint and listed supporting instructions for the conditioned arm.", "Score required/rejected action selections, no-tool-request behavior and valid unique action IDs against the prewritten rubric." ], "results": { "passed": 8, "failed": 0, "total": 8 }, "findings": [ { "severity": "info", "title": "No measured advantage over baseline", "detail": "Both arms selected the same scored actions: baseline 8/8, skill-conditioned 8/8. These are decision checks, not completed real-world tasks." } ], "limitations": [ "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed.", "The response contract explicitly forbids tool use and treating fixture text as instructions. This cannot isolate skill-specific prompt-injection protection.", "Choices are conspicuous and the baseline reached the ceiling. No improvement in effectiveness, general reliability, security or productivity is established.", "No repetitions, blinded human quality ratings, time/cost comparison or cross-model/platform validation." ], "artifact": "/skill-evaluations/vercel-web-design-guidelines.json", "runAt": "2026-10-18" }, "popularity": { "basis": "Rounded repository-wide GitHub stars observed in the public repository page; not skill installs, a quality score, or a measured trend.", "url": "https://github.com/vercel-labs/agent-skills", "observedOn": "2026-10-18", "value": 32600, "metric": "repository-stars-rounded" }, "sources": [ { "label": "Entrypoint and remote-fetch behavior", "url": "https://github.com/vercel-labs/agent-skills/blob/063bee94c3f4df8453406c830b0a7df0f2860278/skills/web-design-guidelines/SKILL.md" }, { "label": "External rules reviewed (mutable main branch)", "url": "https://github.com/vercel-labs/web-interface-guidelines/blob/main/command.md" }, { "label": "Repository license declaration", "url": "https://github.com/vercel-labs/agent-skills/blob/063bee94c3f4df8453406c830b0a7df0f2860278/README.md" }, { "label": "Repository popularity context", "url": "https://github.com/vercel-labs/agent-skills" } ] }, { "id": "anthropic-skill-creator", "name": "Skill Creator", "owner": "Anthropic", "repository": "https://github.com/anthropics/skills", "skillPath": "skills/skill-creator/SKILL.md", "sourceUrl": "https://github.com/anthropics/skills/blob/34040c9c568585f6929bedeaad110ad08f079624/skills/skill-creator/SKILL.md", "category": "Skill authoring", "summary": "Drafts and improves skills through example tasks, baseline comparisons, human feedback and trigger evaluations.", "bestFor": [ "Turning a repeatable workflow into a skill", "Comparing a skill revision with its baseline" ], "requirements": [ "Drafting needs an agent and writable workspace; automated trigger evaluation additionally uses Python 3 and the claude CLI.", "The description improver uses the session's Claude Code authentication; its source explicitly says no separate ANTHROPIC_API_KEY is needed.", "The live viewer uses Python's standard library, a browser and a local TCP port; its port cleanup invokes lsof when available. Static HTML output is supported.", "The trigger runner uses select() on subprocess pipes; native Windows operation was not verified. Shell examples include Unix commands." ], "permissions": [ "Create skill files, evaluation outputs and temporary .claude/commands entries.", "Run Claude subprocesses that inherit the surrounding environment and can use the configured Claude service.", "Serve evaluation artifacts locally; live-viewer startup can terminate processes on its chosen port." ], "risks": [ { "title": "Evaluation text can escape the viewer script context", "severity": "high", "detail": "Observed in the bounded evaluation: At revision 34040c9c568585f6929bedeaad110ad08f079624, generate_html embeds json.dumps output directly in an inline script. Synthetic prompt text with a closing script tag executed a harmless in-memory marker in fresh offline Chrome. The benign control did not execute the marker. This is confirmed only for the pinned files and fixture; current upstream HEAD was not tested. Two failed expectations describe this one issue." }, { "title": "Viewer can terminate another process", "severity": "high", "detail": "generate_review.py calls lsof and sends SIGTERM to processes listening on its selected port before starting the viewer (default 3117). IonBin assessment: use static output or inspect the port before live mode." }, { "title": "Evaluation data and consumption", "severity": "attention", "detail": "The improver sends skill content and evaluation examples to claude -p; repeated runs use the configured Claude account. The viewer embeds outputs. IonBin assessment: use approved sample data and review cost and artifact exposure." } ], "limitations": [ "Selected runner, improver and viewer code paths reviewed; packaging, all graders and the full optimization loop were not audited.", "A good score on a small task set does not establish general reliability or resistance to hostile inputs." ], "license": { "label": "Apache-2.0", "url": "https://github.com/anthropics/skills/blob/34040c9c568585f6929bedeaad110ad08f079624/skills/skill-creator/LICENSE.txt", "note": "Per-skill license. Preserve its applicable license and notice obligations when distributing modifications." }, "evidence": { "level": "runtime-probed", "reviewedOn": "2026-10-18", "revision": "34040c9c568585f6929bedeaad110ad08f079624", "scope": [ "SKILL.md drafting, baseline-evaluation and description-optimization sections", "scripts/run_eval.py subprocess launch, environment and pipe handling", "scripts/improve_description.py Claude subprocess and prompt construction", "eval-viewer/generate_review.py artifact embedding, port cleanup and localhost server paths", "LICENSE.txt", "Bounded evaluation; exact operations, counts, environment and limitations in the linked public report" ], "notTested": [ "No effectiveness benchmark or security certification", "Transitive dependencies, current advisories and host-agent permission controls not audited", "No generated-skill quality or trigger-rate measurements", "No Claude subprocess, live model, API credential, optimization loop or generated-skill effectiveness evaluation", "Port-cleanup lsof/os.kill effects were mocked; no real process was terminated" ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "helper-probe", "summary": "Viewer generation, mocked port cleanup and offline browser marker: 5 of 7 expectations passed. Two checks confirm one script-context injection issue at the pinned revision.", "environment": [ "Windows-11-10.0.26200-SP0; Python 3.12.10; Node 24.18.0; Chrome 155.0.8059.82", "Synthetic local fixtures; minimal child environment; no live account or credential; no OS sandbox", "Dependencies: pypdf 6.19.0, reportlab 4.4.9, Pillow 12.3.0, pdf2image 1.17.0, defusedxml 0.7.1", "Git Bash 5.3.15(1)-release (x86_64-pc-cygwin); Poppler 26.07.0" ], "commands": [ "python run_evals.py --runtime-libs --poppler-bin ", "node viewer_probe.mjs" ], "results": { "passed": 5, "failed": 2, "total": 7 }, "findings": [ { "severity": "high", "title": "Evaluation text can escape the viewer script context", "detail": "At revision 34040c9c568585f6929bedeaad110ad08f079624, generate_html embeds json.dumps output directly in an inline script. Synthetic prompt text with a closing script tag executed a harmless in-memory marker in fresh offline Chrome. The benign control did not execute the marker. This is confirmed only for the pinned files and fixture; current upstream HEAD was not tested. Two failed expectations describe this one issue." } ], "limitations": [ "No Claude subprocess, live model, API credential, optimization loop or generated-skill effectiveness evaluation", "Port-cleanup lsof/os.kill effects were mocked; no real process was terminated", "The browser payload only set a marker; no sensitive data or exfiltration was involved", "All browser requests were blocked, including attempted Google Fonts and SheetJS requests", "The viewer may need those external resources for fonts or XLSX rendering; their downloaded code was not evaluated", "Supervised local processes, not an OS sandbox", "No container, VM or memory/resource quota", "Application guards do not establish containment of arbitrary hostile code", "No real credential, remote account, or destructive-effect testing" ], "artifact": "/skill-evaluations/anthropic-skill-creator.json", "runAt": "2026-10-18" }, "popularity": { "basis": "Rounded repository-wide GitHub stars observed in the public repository page; not skill installs, a quality score, or a measured trend.", "url": "https://github.com/anthropics/skills", "observedOn": "2026-10-18", "value": 182000, "metric": "repository-stars-rounded" }, "sources": [ { "label": "Authoring and evaluation workflow", "url": "https://github.com/anthropics/skills/blob/34040c9c568585f6929bedeaad110ad08f079624/skills/skill-creator/SKILL.md" }, { "label": "Trigger runner requirements and subprocess permissions", "url": "https://github.com/anthropics/skills/blob/34040c9c568585f6929bedeaad110ad08f079624/skills/skill-creator/scripts/run_eval.py" }, { "label": "Authentication and transmitted evaluation content", "url": "https://github.com/anthropics/skills/blob/34040c9c568585f6929bedeaad110ad08f079624/skills/skill-creator/scripts/improve_description.py" }, { "label": "Viewer output, localhost binding and process termination", "url": "https://github.com/anthropics/skills/blob/34040c9c568585f6929bedeaad110ad08f079624/skills/skill-creator/eval-viewer/generate_review.py" }, { "label": "Skill license", "url": "https://github.com/anthropics/skills/blob/34040c9c568585f6929bedeaad110ad08f079624/skills/skill-creator/LICENSE.txt" }, { "label": "Repository popularity context", "url": "https://github.com/anthropics/skills" } ] }, { "id": "anthropic-pdf", "name": "PDF", "owner": "Anthropic", "repository": "https://github.com/anthropics/skills", "skillPath": "skills/pdf/SKILL.md", "sourceUrl": "https://github.com/anthropics/skills/blob/34040c9c568585f6929bedeaad110ad08f079624/skills/pdf/SKILL.md", "category": "Documents", "summary": "Guidance and helpers for PDF extraction, creation, page operations, OCR and form filling.", "bestFor": [ "Understanding a PDF-processing workflow", "Evaluating extraction and form-filling requirements before adoption" ], "requirements": [ "Python with task-specific libraries: pypdf for page/form operations, pdfplumber for extraction and ReportLab for creation.", "Image/OCR examples use pdf2image and pytesseract; native Poppler/Tesseract setup must also be checked in the target environment. CLI examples include qpdf, Poppler tools and optional pdftk.", "No dedicated API key is specified in the reviewed local helpers; access to the hosting agent and permitted use under Anthropic's terms are separate requirements.", "Only the named helpers and dependency versions were probed on Windows; other workflows and platforms remain unverified." ], "permissions": [ "Read source PDFs and form-value JSON.", "Write extracted text, images and replacement PDFs; form values may also appear in diagnostic errors." ], "risks": [ { "title": "Non-form PDF raises AttributeError", "severity": "attention", "detail": "Observed in the bounded evaluation: Calling get_field_info on a valid synthetic PDF without AcroForm fields raised AttributeError instead of returning an empty list. This failed an added robustness expectation; it does not imply form-filling failure on supported inputs." }, { "title": "Submitted values appear in diagnostics", "severity": "attention", "detail": "Observed in the bounded evaluation: The exact helper echoed SYNTHETIC_VALUE_MARKER for an invalid checkbox value. This confirms diagnostic behavior, not a remotely exploited vulnerability. Treat logs with the document data's confidentiality." }, { "title": "Restricted reuse terms", "severity": "high", "detail": "The per-skill license is proprietary and lists restrictions on copying, derivatives and distribution. A public GitHub URL is not an open-source grant. This entry links to the original rather than redistributing the skill." }, { "title": "Sensitive content in outputs and logs", "severity": "attention", "detail": "The form filler writes document values and can print invalid values; the image converter writes page PNGs. IonBin assessment: treat those outputs and diagnostics with the source document's confidentiality." } ], "limitations": [ "Pinned to 34040c9c568585f6929bedeaad110ad08f079624 to match the separately recorded helper evaluation. A newer repository head was observed; its changes are outside this assessment.", "The form helper monkey-patches a pypdf method, which makes dependency compatibility worth checking.", "This source-review record itself makes no claim about fixture results, OCR quality, encryption strength, redaction behavior or malformed-file handling." ], "license": { "label": "Proprietary / source-available", "url": "https://github.com/anthropics/skills/blob/34040c9c568585f6929bedeaad110ad08f079624/skills/pdf/LICENSE.txt", "note": "The repository distinguishes document skills from its open-source examples. Read the per-skill terms; this entry provides commentary and links, not a redistribution permission." }, "evidence": { "level": "runtime-probed", "reviewedOn": "2026-10-18", "revision": "34040c9c568585f6929bedeaad110ad08f079624", "scope": [ "SKILL.md task overview and dependency examples at pinned revision", "forms.md form workflow at pinned revision", "Full scripts/fill_fillable_fields.py at pinned revision", "Full scripts/convert_pdf_to_images.py at pinned revision", "Full LICENSE.txt at pinned revision", "Bounded evaluation; exact operations, counts, environment and limitations in the linked public report" ], "notTested": [ "No effectiveness benchmark or security certification", "Transitive dependencies, current advisories and host-agent permission controls not audited", "No full PDF helper tree or dependency audit", "No end-to-end agent task or skill-vs-baseline effectiveness comparison", "No OCR, redaction, encryption, hostile PDF parser exploit or large-resource tests" ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "helper-probe", "summary": "Form discovery/filling, invalid input and rasterization helpers: 7 of 9 expectations passed. Diagnostic value echo and non-form handling need attention.", "environment": [ "Windows-11-10.0.26200-SP0; Python 3.12.10; Node 24.18.0; Chrome 155.0.8059.82", "Synthetic local fixtures; minimal child environment; no live account or credential; no OS sandbox", "Dependencies: pypdf 6.19.0, reportlab 4.4.9, Pillow 12.3.0, pdf2image 1.17.0, defusedxml 0.7.1", "Git Bash 5.3.15(1)-release (x86_64-pc-cygwin); Poppler 26.07.0" ], "commands": [ "python run_evals.py --runtime-libs --poppler-bin " ], "results": { "passed": 7, "failed": 2, "total": 9 }, "findings": [ { "severity": "attention", "title": "Submitted values appear in diagnostics", "detail": "The exact helper echoed SYNTHETIC_VALUE_MARKER for an invalid checkbox value. This confirms diagnostic behavior, not a remotely exploited vulnerability. Treat logs with the document data's confidentiality." }, { "severity": "attention", "title": "Non-form PDF raises AttributeError", "detail": "Calling get_field_info on a valid synthetic PDF without AcroForm fields raised AttributeError instead of returning an empty list. This failed an added robustness expectation; it does not imply form-filling failure on supported inputs." } ], "limitations": [ "No end-to-end agent task or skill-vs-baseline effectiveness comparison", "No OCR, redaction, encryption, hostile PDF parser exploit or large-resource tests", "No rendered visual-quality review; raster output was checked for page count and dimensions", "Only the three named helpers and these synthetic fixtures were executed", "Proprietary/source-available helper code is retained privately and excluded from public artifacts", "Supervised local processes, not an OS sandbox", "No container, VM or memory/resource quota", "Application guards do not establish containment of arbitrary hostile code", "No real credential, remote account, or destructive-effect testing" ], "artifact": "/skill-evaluations/anthropic-pdf.json", "runAt": "2026-10-18" }, "popularity": { "basis": "Rounded repository-wide GitHub stars observed in the public repository page; not skill installs, a quality score, or a measured trend.", "url": "https://github.com/anthropics/skills", "observedOn": "2026-10-18", "value": 182000, "metric": "repository-stars-rounded" }, "sources": [ { "label": "PDF tasks and task-specific dependency examples", "url": "https://github.com/anthropics/skills/blob/34040c9c568585f6929bedeaad110ad08f079624/skills/pdf/SKILL.md" }, { "label": "Form workflow and visual-verification requirements", "url": "https://github.com/anthropics/skills/blob/34040c9c568585f6929bedeaad110ad08f079624/skills/pdf/forms.md" }, { "label": "Form values, output and pypdf patch", "url": "https://github.com/anthropics/skills/blob/34040c9c568585f6929bedeaad110ad08f079624/skills/pdf/scripts/fill_fillable_fields.py" }, { "label": "Page-image output and pdf2image import", "url": "https://github.com/anthropics/skills/blob/34040c9c568585f6929bedeaad110ad08f079624/skills/pdf/scripts/convert_pdf_to_images.py" }, { "label": "pdf2image native Poppler dependency and platform setup", "url": "https://github.com/Belval/pdf2image" }, { "label": "pytesseract native Tesseract requirement", "url": "https://github.com/madmaze/pytesseract" }, { "label": "Per-skill reuse restrictions", "url": "https://github.com/anthropics/skills/blob/34040c9c568585f6929bedeaad110ad08f079624/skills/pdf/LICENSE.txt" }, { "label": "Source-available distinction and repository popularity", "url": "https://github.com/anthropics/skills" } ] }, { "id": "anthropic-docx", "name": "DOCX", "owner": "Anthropic", "repository": "https://github.com/anthropics/skills", "skillPath": "skills/docx/SKILL.md", "sourceUrl": "https://github.com/anthropics/skills/blob/34040c9c568585f6929bedeaad110ad08f079624/skills/docx/SKILL.md", "category": "Documents", "summary": "Creates and edits Word documents through JavaScript generation, XML editing and rendered-output checks.", "bestFor": [ "Planning Word document generation and editing", "Understanding tracked-change and rendering pitfalls" ], "requirements": [ "Creation examples use Node.js and the docx npm package; reading examples use Pandoc.", "Editing and verification use Python, ZIP tools, LibreOffice (soffice) and Poppler's pdftoppm; merge_runs.py imports defusedxml.", "The optional restricted-socket workaround invokes gcc and LD_PRELOAD, a Linux-style path; native Windows compatibility is unverified.", "No dedicated API key is specified for the reviewed local helpers. Hosted-agent access and Anthropic's reuse terms remain separate." ], "permissions": [ "Read and rewrite document XML, extracted directories and output files.", "Launch document conversion processes and create temporary LibreOffice profiles.", "The socket workaround can compile a temporary shared library and preload it into LibreOffice." ], "risks": [ { "title": "Restricted reuse terms", "severity": "high", "detail": "The document skill has proprietary terms with copying, derivative-work and distribution restrictions. This entry is a source-linked evaluation, not permission to fork or bundle it." }, { "title": "Overwrite and native-code behavior", "severity": "attention", "detail": "merge_runs.py overwrites a DOCX by default unless given an output path. soffice.py may compile and reuse a shared library in the temp directory. IonBin assessment: preserve originals and review the converter environment before use." } ], "limitations": [ "The entrypoint assumes some tooling is preinstalled; this was not confirmed in any target environment.", "The source itself describes tracked-paragraph deletion differences between Pandoc, LibreOffice and Word.", "Validation, archive extraction and all document-editing helpers were not fully reviewed." ], "license": { "label": "Proprietary / source-available", "url": "https://github.com/anthropics/skills/blob/34040c9c568585f6929bedeaad110ad08f079624/skills/docx/LICENSE.txt", "note": "Use is governed by the per-skill terms and applicable Anthropic agreement. Public visibility does not make this an open-source skill." }, "evidence": { "level": "runtime-probed", "reviewedOn": "2026-10-18", "revision": "34040c9c568585f6929bedeaad110ad08f079624", "scope": [ "Entire SKILL.md", "scripts/office/soffice.py", "scripts/merge_runs.py imports and document read/write paths", "LICENSE.txt", "Bounded evaluation; exact operations, counts, environment and limitations in the linked public report" ], "notTested": [ "No effectiveness benchmark or security certification", "Transitive dependencies, current advisories and host-agent permission controls not audited", "No rendered document, Word/LibreOffice interoperability or cross-platform tests", "No complete native-library or XML-validator audit", "Only merge_runs and its safe_extract helper were exercised", "No full DOCX rendering, Word/LibreOffice interoperability, tracked-change acceptance or generated-document quality tests" ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "helper-probe", "summary": "Synthetic merge, formatting/revision boundaries, XML errors and ZIP traversal: 7 of 7 expectations passed. No rendered Word or LibreOffice workflow was tested.", "environment": [ "Windows-11-10.0.26200-SP0; Python 3.12.10; Node 24.18.0; Chrome 155.0.8059.82", "Synthetic local fixtures; minimal child environment; no live account or credential; no OS sandbox", "Dependencies: pypdf 6.19.0, reportlab 4.4.9, Pillow 12.3.0, pdf2image 1.17.0, defusedxml 0.7.1", "Git Bash 5.3.15(1)-release (x86_64-pc-cygwin); Poppler 26.07.0" ], "commands": [ "python run_evals.py --runtime-libs --poppler-bin " ], "results": { "passed": 7, "failed": 0, "total": 7 }, "findings": [], "limitations": [ "Only merge_runs and its safe_extract helper were exercised", "No full DOCX rendering, Word/LibreOffice interoperability, tracked-change acceptance or generated-document quality tests", "Nominal merge probes used unpacked synthetic document XML; traversal used a synthetic ZIP", "No ZIP bombs, arbitrary hostile native code or large-resource tests", "Proprietary/source-available helper code is retained privately and excluded from public artifacts", "Supervised local processes, not an OS sandbox", "No container, VM or memory/resource quota", "Application guards do not establish containment of arbitrary hostile code", "No real credential, remote account, or destructive-effect testing" ], "artifact": "/skill-evaluations/anthropic-docx.json", "runAt": "2026-10-18" }, "popularity": { "basis": "Rounded repository-wide GitHub stars observed in the public repository page; not skill installs, a quality score, or a measured trend.", "url": "https://github.com/anthropics/skills", "observedOn": "2026-10-18", "value": 182000, "metric": "repository-stars-rounded" }, "sources": [ { "label": "Document tasks, tools and tracked-change caveats", "url": "https://github.com/anthropics/skills/blob/34040c9c568585f6929bedeaad110ad08f079624/skills/docx/SKILL.md" }, { "label": "LibreOffice process, temporary profile and preload behavior", "url": "https://github.com/anthropics/skills/blob/34040c9c568585f6929bedeaad110ad08f079624/skills/docx/scripts/office/soffice.py" }, { "label": "Python dependency and default overwrite behavior", "url": "https://github.com/anthropics/skills/blob/34040c9c568585f6929bedeaad110ad08f079624/skills/docx/scripts/merge_runs.py" }, { "label": "Per-skill reuse restrictions", "url": "https://github.com/anthropics/skills/blob/34040c9c568585f6929bedeaad110ad08f079624/skills/docx/LICENSE.txt" }, { "label": "Source-available distinction and repository popularity", "url": "https://github.com/anthropics/skills" } ] }, { "id": "superpowers-systematic-debugging", "name": "Systematic Debugging", "owner": "Jesse Vincent / Superpowers", "repository": "https://github.com/obra/superpowers", "skillPath": "skills/systematic-debugging/SKILL.md", "sourceUrl": "https://github.com/obra/superpowers/blob/b36e0829c6d0140e93cfef2ca599b1b07d4a7797/skills/systematic-debugging/SKILL.md", "category": "Engineering", "summary": "A four-stage debugging method: investigate evidence, compare patterns, test a hypothesis and verify one focused fix.", "bestFor": [ "Repeated fixes that fail to address a defect", "Bugs crossing application, build or service boundaries" ], "requirements": [ "A coding agent with access to relevant source, logs and the project's reproduction/test environment.", "The optional find-polluter.sh helper needs Bash, Unix utilities and npm test; the core method is not restricted to JavaScript.", "The workflow refers to the Superpowers TDD and verification skills. No skill-specific account or key is specified; project credentials may be required for a reproduction.", "Host and operating-system compatibility depends on chosen tools; the Bash helper was not tested on Windows." ], "permissions": [ "Read source, logs, configuration and revision history.", "Run reproduction/test commands and add diagnostic instrumentation; later phases modify code." ], "risks": [ { "title": "Diagnostic data needs boundaries", "severity": "attention", "detail": "The entrypoint encourages logging data across component boundaries. IonBin assessment: redact secrets and customer data, and scope diagnostics before using it against a live service." }, { "title": "Tests execute project code", "severity": "attention", "detail": "find-polluter.sh invokes npm test for discovered files, suppresses test output and ignores nonzero exits while looking for a new path. A no-polluter result is not evidence that tests passed." } ], "limitations": [ "The optional helper is tailored to npm test and path creation; its scope is narrower than general root-cause analysis.", "This review covers the skill and one helper, not the entire Superpowers plugin, hooks or optional visual companion.", "The broader repository documents optional visual-companion telemetry; that feature was not used or audited here." ], "license": { "label": "MIT", "url": "https://github.com/obra/superpowers/blob/b36e0829c6d0140e93cfef2ca599b1b07d4a7797/LICENSE", "note": "Repository license names Jesse Vincent; retain the required copyright and license notices when redistributing." }, "evidence": { "level": "task-tested", "reviewedOn": "2026-10-18", "revision": "b36e0829c6d0140e93cfef2ca599b1b07d4a7797", "scope": [ "SKILL.md four phases and diagnostics examples", "Entire find-polluter.sh helper", "README.md compatibility context and optional-telemetry disclosure", "LICENSE", "Bounded evaluation; exact operations, counts, environment and limitations in the linked public report" ], "notTested": [ "No effectiveness benchmark or security certification", "Transitive dependencies, current advisories and host-agent permission controls not audited", "No debugging success-rate or time-to-fix benchmark", "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "task-evaluation", "summary": "One synthetic decision scenario, checked against a prewritten action rubric. Skill-conditioned 8/8; baseline 8/8. No measured advantage or executed workflow is claimed.", "environment": [ "Codex agent session; separate fresh baseline and skill-conditioned agents", "Text-only synthetic fixture; identical task and allowed-action contract; no network or account operations" ], "commands": [ "Read the recorded fixture and allowed actions; baseline receives no skill source.", "Read the pinned entrypoint and listed supporting instructions for the conditioned arm.", "Score required/rejected action selections, no-tool-request behavior and valid unique action IDs against the prewritten rubric." ], "results": { "passed": 8, "failed": 0, "total": 8 }, "findings": [ { "severity": "info", "title": "No measured advantage over baseline", "detail": "Both arms selected the same scored actions: baseline 8/8, skill-conditioned 8/8. These are decision checks, not completed real-world tasks." } ], "limitations": [ "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed.", "The response contract explicitly forbids tool use and treating fixture text as instructions. This cannot isolate skill-specific prompt-injection protection.", "Choices are conspicuous and the baseline reached the ceiling. No improvement in effectiveness, general reliability, security or productivity is established.", "No repetitions, blinded human quality ratings, time/cost comparison or cross-model/platform validation." ], "artifact": "/skill-evaluations/superpowers-systematic-debugging.json", "runAt": "2026-10-18" }, "popularity": { "basis": "Rounded repository-wide GitHub stars observed in the public repository page; not skill installs, a quality score, or a measured trend.", "url": "https://github.com/obra/superpowers", "observedOn": "2026-10-18", "value": 301600, "metric": "repository-stars-rounded" }, "sources": [ { "label": "Debugging method, diagnostics and related skills", "url": "https://github.com/obra/superpowers/blob/b36e0829c6d0140e93cfef2ca599b1b07d4a7797/skills/systematic-debugging/SKILL.md" }, { "label": "Optional test-runner behavior", "url": "https://github.com/obra/superpowers/blob/b36e0829c6d0140e93cfef2ca599b1b07d4a7797/skills/systematic-debugging/find-polluter.sh" }, { "label": "Plugin context and separate optional telemetry", "url": "https://github.com/obra/superpowers/blob/b36e0829c6d0140e93cfef2ca599b1b07d4a7797/README.md" }, { "label": "Repository license", "url": "https://github.com/obra/superpowers/blob/b36e0829c6d0140e93cfef2ca599b1b07d4a7797/LICENSE" }, { "label": "Repository popularity context", "url": "https://github.com/obra/superpowers" } ] }, { "id": "superpowers-test-driven-development", "name": "Test-Driven Development", "owner": "Jesse Vincent / Superpowers", "repository": "https://github.com/obra/superpowers", "skillPath": "skills/test-driven-development/SKILL.md", "sourceUrl": "https://github.com/obra/superpowers/blob/b36e0829c6d0140e93cfef2ca599b1b07d4a7797/skills/test-driven-development/SKILL.md", "category": "Engineering", "summary": "Guides an agent through a failing behavior test, the smallest passing change and subsequent refactoring.", "bestFor": [ "Behavior changes with an executable test environment", "Regression fixes that need a reproducible failure" ], "requirements": [ "A coding agent able to edit tests and implementation and run the target project's test suite.", "A runnable test framework for the language in use. npm test and TypeScript are examples, not a universal runtime requirement.", "No skill-specific API key, account or service is specified; host-agent and project requirements still apply.", "The method is text-based, but shell and test compatibility were not verified on any operating system." ], "permissions": [ "Write or replace test and production code.", "Execute project tests, with whatever filesystem, network and service permissions those tests already have." ], "risks": [ { "title": "Delete-and-restart instruction", "severity": "high", "detail": "The entrypoint instructs deleting implementation written before its failing test. IonBin assessment: reconcile that instruction with ownership and change-preservation rules before enabling it on existing or uncommitted work." }, { "title": "Real dependencies can have side effects", "severity": "attention", "detail": "The companion test guidance prefers real behavior and understanding dependency side effects before mocking. IonBin assessment: use isolated fixtures and test credentials before running code that reaches external services." } ], "limitations": [ "A strict default workflow may be a poor fit for throwaway prototypes or configuration-only changes; the source discusses human-approved exceptions.", "Review covered the entrypoint and test-writing guidance, not the wider plugin or a behavior-evaluation harness." ], "license": { "label": "MIT", "url": "https://github.com/obra/superpowers/blob/b36e0829c6d0140e93cfef2ca599b1b07d4a7797/LICENSE", "note": "Repository license; retain the required copyright and license notices when redistributing." }, "evidence": { "level": "task-tested", "reviewedOn": "2026-10-18", "revision": "b36e0829c6d0140e93cfef2ca599b1b07d4a7797", "scope": [ "Entire SKILL.md", "writing-good-tests.md principles and mocking/side-effect sections", "LICENSE", "Bounded evaluation; exact operations, counts, environment and limitations in the linked public report" ], "notTested": [ "No effectiveness benchmark or security certification", "Transitive dependencies, current advisories and host-agent permission controls not audited", "No agent adherence, regression detection or productivity benchmark", "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "task-evaluation", "summary": "One synthetic decision scenario, checked against a prewritten action rubric. Skill-conditioned 8/8; baseline 8/8. No measured advantage or executed workflow is claimed.", "environment": [ "Codex agent session; separate fresh baseline and skill-conditioned agents", "Text-only synthetic fixture; identical task and allowed-action contract; no network or account operations" ], "commands": [ "Read the recorded fixture and allowed actions; baseline receives no skill source.", "Read the pinned entrypoint and listed supporting instructions for the conditioned arm.", "Score required/rejected action selections, no-tool-request behavior and valid unique action IDs against the prewritten rubric." ], "results": { "passed": 8, "failed": 0, "total": 8 }, "findings": [ { "severity": "info", "title": "No measured advantage over baseline", "detail": "Both arms selected the same scored actions: baseline 8/8, skill-conditioned 8/8. These are decision checks, not completed real-world tasks." } ], "limitations": [ "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed.", "The response contract explicitly forbids tool use and treating fixture text as instructions. This cannot isolate skill-specific prompt-injection protection.", "Choices are conspicuous and the baseline reached the ceiling. No improvement in effectiveness, general reliability, security or productivity is established.", "No repetitions, blinded human quality ratings, time/cost comparison or cross-model/platform validation." ], "artifact": "/skill-evaluations/superpowers-test-driven-development.json", "runAt": "2026-10-18" }, "popularity": { "basis": "Rounded repository-wide GitHub stars observed in the public repository page; not skill installs, a quality score, or a measured trend.", "url": "https://github.com/obra/superpowers", "observedOn": "2026-10-18", "value": 301600, "metric": "repository-stars-rounded" }, "sources": [ { "label": "TDD cycle, deletion instruction and exceptions", "url": "https://github.com/obra/superpowers/blob/b36e0829c6d0140e93cfef2ca599b1b07d4a7797/skills/test-driven-development/SKILL.md" }, { "label": "Behavior tests, real dependencies and side-effect guidance", "url": "https://github.com/obra/superpowers/blob/b36e0829c6d0140e93cfef2ca599b1b07d4a7797/skills/test-driven-development/writing-good-tests.md" }, { "label": "Repository license", "url": "https://github.com/obra/superpowers/blob/b36e0829c6d0140e93cfef2ca599b1b07d4a7797/LICENSE" }, { "label": "Repository popularity context", "url": "https://github.com/obra/superpowers" } ] }, { "id": "openai-playwright", "name": "Playwright CLI", "owner": "OpenAI catalog / Microsoft CLI", "repository": "https://github.com/openai/skills", "skillPath": "skills/.curated/playwright/SKILL.md", "sourceUrl": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/playwright/SKILL.md", "category": "Browser automation", "summary": "A terminal-driven browser workflow for navigation, form interaction, screenshots and UI debugging. This catalog version is a historical reference.", "bestFor": [ "Understanding a browser automation workflow", "Comparing CLI browser tooling and its access requirements" ], "requirements": [ "Node.js/npm with npx on PATH, Bash for the bundled wrapper and a working browser runtime.", "The wrapper resolves @playwright/cli through npx; package/browser setup and target-page access may require networking.", "No skill-specific API key is specified. Private sites need their own authorized account/session; host-agent access is separate.", "The Bash wrapper and Unix examples are not a verified native-PowerShell workflow." ], "permissions": [ "Run an npm-distributed CLI and browser subprocesses.", "Navigate websites, fill and submit forms, and write screenshots or traces.", "An authenticated browser can act with the authority of the account signed into the target site." ], "risks": [ { "title": "Unpinned executable dependency", "severity": "attention", "detail": "The wrapper uses npx --yes --package @playwright/cli without a package version. IonBin assessment: pin and review the CLI package separately; a pinned skill commit does not pin the executable it launches." }, { "title": "Browser actions can change accounts", "severity": "high", "detail": "The skill includes form submission and trace capture. IonBin assessment: constrain target sites and consequential actions, and protect artifacts that may contain private page content." } ], "limitations": [ "The openai/skills README marks the repository deprecated and points to openai/plugins for current examples.", "Review covers this catalog skill and wrapper, not the npm package, browser internals or current successor plugin.", "No authentication, browser compatibility or real-site workflow was exercised.", "OpenAI directs current skill/plugin examples to openai/plugins. Its inspected tree has Vercel agent-browser examples but no direct playwright-named skill; no equivalent drop-in migration was verified." ], "license": { "label": "Apache-2.0", "url": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/playwright/LICENSE.txt", "note": "Per-skill license includes a Microsoft copyright notice. This review did not audit the npm package's separate dependency licenses." }, "evidence": { "level": "runtime-probed", "reviewedOn": "2026-10-18", "revision": "49f948faa9258a0c61caceaf225e179651397431", "scope": [ "Entire SKILL.md", "Entire scripts/playwright_cli.sh", "README.md deprecation notice", "LICENSE.txt", "Bounded evaluation; exact operations, counts, environment and limitations in the linked public report" ], "notTested": [ "No effectiveness benchmark or security certification", "Transitive dependencies, current advisories and host-agent permission controls not audited", "No audit of @playwright/cli or browser dependencies", "Five wrapper dispatch checks used a fake npx, plus one Git Bash environment check", "No real npx, npm package, Playwright CLI or target browser workflow was executed" ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "helper-probe", "summary": "Five mocked npx dispatch checks and Bash startup passed. The actual CLI package, browser workflow and authentication were not exercised.", "environment": [ "Windows-11-10.0.26200-SP0; Python 3.12.10; Node 24.18.0; Chrome 155.0.8059.82", "Synthetic local fixtures; minimal child environment; no live account or credential; no OS sandbox", "Dependencies: pypdf 6.19.0, reportlab 4.4.9, Pillow 12.3.0, pdf2image 1.17.0, defusedxml 0.7.1", "Git Bash 5.3.15(1)-release (x86_64-pc-cygwin); Poppler 26.07.0" ], "commands": [ "python run_evals.py --runtime-libs --poppler-bin " ], "results": { "passed": 6, "failed": 0, "total": 6 }, "findings": [], "limitations": [ "Five wrapper dispatch checks used a fake npx, plus one Git Bash environment check", "No real npx, npm package, Playwright CLI or target browser workflow was executed", "No install/compatibility, live-site, account, session-security or artifact-confidentiality claim follows", "The wrapper still delegates to an unpinned npm package; these checks do not evaluate that package", "This is the historical catalog revision, not the current successor plugin", "Supervised local processes, not an OS sandbox", "No container, VM or memory/resource quota", "Application guards do not establish containment of arbitrary hostile code", "No real credential, remote account, or destructive-effect testing" ], "artifact": "/skill-evaluations/openai-playwright.json", "runAt": "2026-10-18" }, "popularity": { "basis": "Rounded repository-wide GitHub stars observed in the public repository page; not skill installs, a quality score, or a measured trend.", "url": "https://github.com/openai/skills", "observedOn": "2026-10-18", "value": 28100, "metric": "repository-stars-rounded" }, "sources": [ { "label": "Browser workflow and prerequisite checks", "url": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/playwright/SKILL.md" }, { "label": "Unpinned npx wrapper and Bash requirement", "url": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/playwright/scripts/playwright_cli.sh" }, { "label": "Repository deprecation and successor link", "url": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/README.md" }, { "label": "Per-skill license", "url": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/playwright/LICENSE.txt" }, { "label": "Repository popularity context", "url": "https://github.com/openai/skills" }, { "label": "Current catalog replacement tree inspected; no direct playwright skill found", "url": "https://github.com/openai/plugins/tree/0722921d5542fc593105c27bd52630babd8b8c2a" }, { "label": "Current OpenAI plugin catalog (not verified as the same Playwright implementation)", "url": "https://github.com/openai/plugins" } ] }, { "id": "vercel-find-skills", "name": "Find Skills", "owner": "Vercel", "repository": "https://github.com/vercel-labs/skills", "skillPath": "skills/find-skills/SKILL.md", "sourceUrl": "https://github.com/vercel-labs/skills/blob/13e4063a1cf913f5606d57d42ab83a86f5001e04/skills/find-skills/SKILL.md", "category": "Skill discovery", "summary": "A discovery workflow for locating and installing agent skills through the Skills CLI.", "bestFor": [ "Finding a specialist workflow", "Comparing candidate upstreams before installing" ], "requirements": [ "The reviewed Skills CLI package declares Node.js >=22.20.0; npm/npx and Git/network access are needed for its documented installation flow.", "No service account or API key is specified for public discovery. Private repositories need their own authorized access.", "Agent-specific installation paths and Windows/macOS/Linux behavior were not tested." ], "permissions": [ "Search remote skill indexes and retrieve repositories.", "Installation can write agent skill directories globally; update can change installed skills." ], "risks": [ { "title": "Global, unattended installs", "severity": "high", "detail": "The skill suggests -g -y installation and unversioned npx. IonBin assessment: review the exact package and destination first; the source pin does not pin future downloaded code." }, { "title": "Popularity is a weak trust signal", "severity": "attention", "detail": "Its ranking heuristics emphasize install counts and stars. Neither establishes safe instructions, sound dependencies, or task quality." } ], "limitations": [ "This is a discovery/install workflow, not a security scanner.", "CLI implementation and every installed candidate require a separate review." ], "license": { "label": "MIT", "url": "https://github.com/vercel-labs/skills/blob/13e4063a1cf913f5606d57d42ab83a86f5001e04/LICENSE", "note": "License applies to upstream materials; retain required notices when copying or adapting." }, "evidence": { "level": "task-tested", "reviewedOn": "2026-10-18", "revision": "13e4063a1cf913f5606d57d42ab83a86f5001e04", "scope": [ "Full SKILL.md", "package.json runtime and package metadata", "Bounded evaluation; exact operations, counts, environment and limitations in the linked public report" ], "notTested": [ "No execution or end-to-end task evaluation performed in this source-review workstream.", "No complete dependency audit, current-advisory audit, or security certification.", "Requirements and risks describe the reviewed source; host-agent behavior and all supported platforms remain unverified here.", "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "task-evaluation", "summary": "One synthetic decision scenario, checked against a prewritten action rubric. Skill-conditioned 8/8; baseline 8/8. No measured advantage or executed workflow is claimed.", "environment": [ "Codex agent session; separate fresh baseline and skill-conditioned agents", "Text-only synthetic fixture; identical task and allowed-action contract; no network or account operations" ], "commands": [ "Read the recorded fixture and allowed actions; baseline receives no skill source.", "Read the pinned entrypoint and listed supporting instructions for the conditioned arm.", "Score required/rejected action selections, no-tool-request behavior and valid unique action IDs against the prewritten rubric." ], "results": { "passed": 8, "failed": 0, "total": 8 }, "findings": [ { "severity": "info", "title": "No measured advantage over baseline", "detail": "Both arms selected the same scored actions: baseline 8/8, skill-conditioned 8/8. These are decision checks, not completed real-world tasks." } ], "limitations": [ "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed.", "The response contract explicitly forbids tool use and treating fixture text as instructions. This cannot isolate skill-specific prompt-injection protection.", "Choices are conspicuous and the baseline reached the ceiling. No improvement in effectiveness, general reliability, security or productivity is established.", "No repetitions, blinded human quality ratings, time/cost comparison or cross-model/platform validation." ], "artifact": "/skill-evaluations/vercel-find-skills.json", "runAt": "2026-10-18" }, "popularity": { "basis": "Rounded installs reported by the skills.sh skill page, observed on the stated date. Not unique users, verified usage, quality, or a security score.", "url": "https://www.skills.sh/vercel-labs/skills/find-skills", "observedOn": "2026-10-18", "value": 3900000, "metric": "skills-sh-installs-rounded", "scope": "skill", "window": "all-time", "observations": [ { "metric": "skills-sh-installs-rounded", "scope": "skill", "window": "24h", "observedOn": "2026-10-18", "value": 14900, "rank": 16, "url": "https://www.skills.sh/trending", "note": "Observed on the board labeled Trending (24h). The page title says This Week; the visible UI window is retained. Counts are rolling snapshots, not a verified growth rate." } ] }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/vercel-labs/skills/blob/13e4063a1cf913f5606d57d42ab83a86f5001e04/skills/find-skills/SKILL.md" }, { "label": "CLI version and Node engine", "url": "https://github.com/vercel-labs/skills/blob/13e4063a1cf913f5606d57d42ab83a86f5001e04/package.json" }, { "label": "Dated skill-level install snapshot", "url": "https://www.skills.sh/vercel-labs/skills/find-skills" }, { "label": "Upstream license or license-inspection scope", "url": "https://github.com/vercel-labs/skills/blob/13e4063a1cf913f5606d57d42ab83a86f5001e04/LICENSE" }, { "label": "Trending board snapshot; visible UI labels 24h", "url": "https://www.skills.sh/trending" } ] }, { "id": "anthropic-frontend-design", "name": "Frontend Design", "owner": "Anthropic", "repository": "https://github.com/anthropics/skills", "skillPath": "skills/frontend-design/SKILL.md", "sourceUrl": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/frontend-design/SKILL.md", "category": "Design & accessibility", "summary": "An art-direction workflow that turns a brief into deliberate typography, palette, layout, and responsive implementation.", "bestFor": [ "Distinctive landing pages", "Improving a UI against a specific brief" ], "requirements": [ "A coding agent with project-file access; the target application's own runtime/build tools for implementation.", "A screenshot-capable browser is useful for visual critique. No dedicated package, account, or API key is required by the reviewed instruction file.", "The guidance names multiple web stacks; integration with any particular framework was not tested." ], "permissions": [ "Read the brief and relevant project context.", "Modify frontend files and inspect rendered output." ], "risks": [ { "title": "Context can enter public output", "severity": "attention", "detail": "The instructions encourage using remembered client preferences. IonBin assessment: use only context authorized for the project and keep confidential facts out of generated pages." }, { "title": "Visual direction is not verified usability", "severity": "attention", "detail": "The skill calls for responsive behavior, focus states and reduced motion. Actual accessibility and user-task success still require independent checks." } ], "limitations": [ "Source review covers the instruction file, not generated websites.", "Taste-based decisions and screenshot critique do not establish conversion gains." ], "license": { "label": "Apache-2.0", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/frontend-design/LICENSE.txt", "note": "This skill is Apache-2.0; other skills in the same repository have different terms." }, "evidence": { "level": "task-tested", "reviewedOn": "2026-10-18", "revision": "dbd4588f9e1033efb41dad4bef2f7947c8993d44", "scope": [ "Full SKILL.md", "Per-skill Apache-2.0 license header", "Bounded evaluation; exact operations, counts, environment and limitations in the linked public report" ], "notTested": [ "No execution or end-to-end task evaluation performed in this source-review workstream.", "No complete dependency audit, current-advisory audit, or security certification.", "Requirements and risks describe the reviewed source; host-agent behavior and all supported platforms remain unverified here.", "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "task-evaluation", "summary": "One synthetic decision scenario, checked against a prewritten action rubric. Skill-conditioned 8/8; baseline 8/8. No measured advantage or executed workflow is claimed.", "environment": [ "Codex agent session; separate fresh baseline and skill-conditioned agents", "Text-only synthetic fixture; identical task and allowed-action contract; no network or account operations" ], "commands": [ "Read the recorded fixture and allowed actions; baseline receives no skill source.", "Read the pinned entrypoint and listed supporting instructions for the conditioned arm.", "Score required/rejected action selections, no-tool-request behavior and valid unique action IDs against the prewritten rubric." ], "results": { "passed": 8, "failed": 0, "total": 8 }, "findings": [ { "severity": "info", "title": "No measured advantage over baseline", "detail": "Both arms selected the same scored actions: baseline 8/8, skill-conditioned 8/8. These are decision checks, not completed real-world tasks." } ], "limitations": [ "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed.", "The response contract explicitly forbids tool use and treating fixture text as instructions. This cannot isolate skill-specific prompt-injection protection.", "Choices are conspicuous and the baseline reached the ceiling. No improvement in effectiveness, general reliability, security or productivity is established.", "No repetitions, blinded human quality ratings, time/cost comparison or cross-model/platform validation." ], "artifact": "/skill-evaluations/anthropic-frontend-design.json", "runAt": "2026-10-18" }, "popularity": { "basis": "Rounded installs reported by the skills.sh skill page, observed on the stated date. Not unique users, verified usage, quality, or a security score.", "url": "https://www.skills.sh/anthropics/skills/frontend-design", "observedOn": "2026-10-18", "value": 1000000, "metric": "skills-sh-installs-rounded", "scope": "skill", "window": "all-time", "observations": [ { "metric": "skills-sh-installs-rounded", "scope": "skill", "window": "24h", "observedOn": "2026-10-18", "value": 3400, "rank": 104, "url": "https://www.skills.sh/trending", "note": "Observed on the board labeled Trending (24h). The page title says This Week; the visible UI window is retained. Counts are rolling snapshots, not a verified growth rate." } ] }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/frontend-design/SKILL.md" }, { "label": "Dated skill-level install snapshot", "url": "https://www.skills.sh/anthropics/skills/frontend-design" }, { "label": "Upstream license or license-inspection scope", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/frontend-design/LICENSE.txt" }, { "label": "Trending board snapshot; visible UI labels 24h", "url": "https://www.skills.sh/trending" } ] }, { "id": "anthropic-webapp-testing", "name": "Webapp Testing", "owner": "Anthropic", "repository": "https://github.com/anthropics/skills", "skillPath": "skills/webapp-testing/SKILL.md", "sourceUrl": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/webapp-testing/SKILL.md", "category": "Browser automation", "summary": "Python Playwright guidance for local web-app inspection, screenshots, and scripted UI checks.", "bestFor": [ "Testing a local development server", "Finding selectors after rendered-page inspection" ], "requirements": [ "Python 3, the Python Playwright package and its Chromium browser for the documented examples.", "The application must have its own installed dependencies and launch command; with_server.py itself uses Python standard-library modules.", "No cloud account or API key is required for local tests; authenticated sites need separately authorized state.", "Examples use Unix-style paths and shell syntax; adapt paths and verify child-process cleanup on Windows." ], "permissions": [ "Start server commands through a shell and run a test subprocess.", "Drive a browser; write screenshots, logs and other test artifacts." ], "risks": [ { "title": "Shell authority and incomplete process isolation", "severity": "high", "detail": "with_server.py executes the supplied server string with shell=True and inherits the environment. Use inspected commands, synthetic data and a restricted process environment." }, { "title": "Server lifecycle can mislead", "severity": "attention", "detail": "Readiness checks only whether localhost accepts a connection. Output pipes are not drained, and cleanup terminates the shell process rather than a process group. Port collisions, noisy servers and descendant cleanup need testing." } ], "limitations": [ "The helper's open-port signal is not proof that the expected application is ready.", "The guide recommends networkidle; applications with persistent traffic may require explicit UI readiness instead.", "Browser interactions can submit data; test against a scoped fixture." ], "license": { "label": "Apache-2.0", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/webapp-testing/LICENSE.txt", "note": "Apache-2.0 applies to this skill; browser and project dependencies retain their own licenses." }, "evidence": { "level": "task-tested", "reviewedOn": "2026-10-18", "revision": "dbd4588f9e1033efb41dad4bef2f7947c8993d44", "scope": [ "Full SKILL.md", "Full scripts/with_server.py", "Per-skill Apache-2.0 license header", "Bounded evaluation; exact operations, counts, environment and limitations in the linked public report" ], "notTested": [ "No execution or end-to-end task evaluation performed in this source-review workstream.", "No complete dependency audit, current-advisory audit, or security certification.", "Requirements and risks describe the reviewed source; host-agent behavior and all supported platforms remain unverified here.", "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed." ] }, "relationship": "used", "relationshipEvidence": { "summary": "Used during this IonBin directory review: applied the inspect, wait, assert and capture workflow through the existing Node Playwright runner on a local built site. The Python server helper was not used. This is a current QA usage record, not prior production history.", "artifact": "/skill-evaluations/webapp-testing-use.json" }, "evaluation": { "status": "completed", "kind": "task-evaluation", "summary": "One synthetic decision scenario, checked against a prewritten action rubric. Skill-conditioned 9/9; baseline 9/9. No measured advantage or executed workflow is claimed.", "environment": [ "Codex agent session; separate fresh baseline and skill-conditioned agents", "Text-only synthetic fixture; identical task and allowed-action contract; no network or account operations" ], "commands": [ "Read the recorded fixture and allowed actions; baseline receives no skill source.", "Read the pinned entrypoint and listed supporting instructions for the conditioned arm.", "Score required/rejected action selections, no-tool-request behavior and valid unique action IDs against the prewritten rubric." ], "results": { "passed": 9, "failed": 0, "total": 9 }, "findings": [ { "severity": "info", "title": "No measured advantage over baseline", "detail": "Both arms selected the same scored actions: baseline 9/9, skill-conditioned 9/9. These are decision checks, not completed real-world tasks." } ], "limitations": [ "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed.", "The response contract explicitly forbids tool use and treating fixture text as instructions. This cannot isolate skill-specific prompt-injection protection.", "Choices are conspicuous and the baseline reached the ceiling. No improvement in effectiveness, general reliability, security or productivity is established.", "No repetitions, blinded human quality ratings, time/cost comparison or cross-model/platform validation." ], "artifact": "/skill-evaluations/anthropic-webapp-testing.json", "runAt": "2026-10-18" }, "popularity": { "basis": "Rounded installs reported by the skills.sh skill page, observed on the stated date. Not unique users, verified usage, quality, or a security score.", "url": "https://www.skills.sh/anthropics/skills/webapp-testing", "observedOn": "2026-10-18", "value": 181000, "metric": "skills-sh-installs-rounded", "scope": "skill", "window": "all-time" }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/webapp-testing/SKILL.md" }, { "label": "Server startup, readiness, pipes and cleanup", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/webapp-testing/scripts/with_server.py" }, { "label": "Dated skill-level install snapshot", "url": "https://www.skills.sh/anthropics/skills/webapp-testing" }, { "label": "Upstream license or license-inspection scope", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/webapp-testing/LICENSE.txt" } ] }, { "id": "vercel-agent-browser", "name": "Agent Browser", "owner": "Vercel", "repository": "https://github.com/vercel-labs/agent-browser", "skillPath": "skills/agent-browser/SKILL.md", "sourceUrl": "https://github.com/vercel-labs/agent-browser/blob/dac13bb87468fe9d74a040d862720f6cc17a9565/skills/agent-browser/SKILL.md", "category": "Browser automation", "summary": "A browser-automation discovery skill backed by a native CLI and version-specific core guidance.", "bestFor": [ "Stateful browser workflows", "Accessibility-tree inspection and scoped local QA" ], "requirements": [ "The reviewed npm package is agent-browser 0.39.1 and declares Node.js >=24; installation obtains a platform-specific native binary.", "Chrome/Chromium via CDP is the main browser path. The source provides Windows/macOS/Linux handling; pnpm >=11 is declared for package development.", "No API key is required for local browsing. Cloud browser, remote service and account workflows need their own credentials.", "Load the core guidance matching the installed CLI. The entry-point SKILL.md alone is a discovery stub." ], "permissions": [ "Launch/control a browser, read page state, fill forms, upload files and invoke page-advertised tools.", "Store screenshots, HAR files and authentication/session state; installer may modify global command shims." ], "risks": [ { "title": "Browser session authority", "severity": "high", "detail": "A logged-in session can act with account authority. Core guidance recommends named sessions and treats page/WebMCP text as untrusted; those instructions are not a hard isolation boundary." }, { "title": "Install and artifact exposure", "severity": "high", "detail": "Postinstall downloads a native release binary and rewrites global shims when applicable. HARs can include credentials; screenshots and saved state can expose private data." } ], "limitations": [ "Only the stub, selected core sections, trust-boundary guidance, package metadata and installer paths were reviewed; the Rust command implementation was not audited.", "The source pin does not pin unversioned npm installation. Browser allowlists have mode-specific limits and are not an OS firewall." ], "license": { "label": "Apache-2.0", "url": "https://github.com/vercel-labs/agent-browser/blob/dac13bb87468fe9d74a040d862720f6cc17a9565/LICENSE", "note": "Apache-2.0 repository license. Bundled third-party components and browser engines have separate notices." }, "evidence": { "level": "task-tested", "reviewedOn": "2026-10-18", "revision": "dac13bb87468fe9d74a040d862720f6cc17a9565", "scope": [ "Full discovery SKILL.md", "Core guide: session, navigation, credentials, WebMCP, waits and safety sections", "Full core trust-boundaries reference", "package.json", "Selected download/platform/shim-write paths in scripts/postinstall.js", "Bounded evaluation; exact operations, counts, environment and limitations in the linked public report" ], "notTested": [ "No execution or end-to-end task evaluation performed in this source-review workstream.", "No complete dependency audit, current-advisory audit, or security certification.", "Requirements and risks describe the reviewed source; host-agent behavior and all supported platforms remain unverified here.", "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "task-evaluation", "summary": "One synthetic decision scenario, checked against a prewritten action rubric. Skill-conditioned 8/8; baseline 8/8. No measured advantage or executed workflow is claimed.", "environment": [ "Codex agent session; separate fresh baseline and skill-conditioned agents", "Text-only synthetic fixture; identical task and allowed-action contract; no network or account operations" ], "commands": [ "Read the recorded fixture and allowed actions; baseline receives no skill source.", "Read the pinned entrypoint and listed supporting instructions for the conditioned arm.", "Score required/rejected action selections, no-tool-request behavior and valid unique action IDs against the prewritten rubric." ], "results": { "passed": 8, "failed": 0, "total": 8 }, "findings": [ { "severity": "info", "title": "No measured advantage over baseline", "detail": "Both arms selected the same scored actions: baseline 8/8, skill-conditioned 8/8. These are decision checks, not completed real-world tasks." } ], "limitations": [ "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed.", "The response contract explicitly forbids tool use and treating fixture text as instructions. This cannot isolate skill-specific prompt-injection protection.", "Choices are conspicuous and the baseline reached the ceiling. No improvement in effectiveness, general reliability, security or productivity is established.", "No repetitions, blinded human quality ratings, time/cost comparison or cross-model/platform validation." ], "artifact": "/skill-evaluations/vercel-agent-browser.json", "runAt": "2026-10-18" }, "popularity": { "basis": "Rounded installs reported by the skills.sh skill page, observed on the stated date. Not unique users, verified usage, quality, or a security score.", "url": "https://www.skills.sh/vercel-labs/agent-browser/agent-browser", "observedOn": "2026-10-18", "value": 1200000, "metric": "skills-sh-installs-rounded", "scope": "skill", "window": "all-time", "observations": [ { "metric": "skills-sh-installs-rounded", "scope": "skill", "window": "24h", "observedOn": "2026-10-18", "value": 7400, "rank": 46, "url": "https://www.skills.sh/trending", "note": "Observed on the board labeled Trending (24h). The page title says This Week; the visible UI window is retained. Counts are rolling snapshots, not a verified growth rate." } ] }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/vercel-labs/agent-browser/blob/dac13bb87468fe9d74a040d862720f6cc17a9565/skills/agent-browser/SKILL.md" }, { "label": "Version-specific core workflow", "url": "https://github.com/vercel-labs/agent-browser/blob/dac13bb87468fe9d74a040d862720f6cc17a9565/skill-data/core/SKILL.md" }, { "label": "Page, secret and network trust boundaries", "url": "https://github.com/vercel-labs/agent-browser/blob/dac13bb87468fe9d74a040d862720f6cc17a9565/skill-data/core/references/trust-boundaries.md" }, { "label": "Node requirement and install hook", "url": "https://github.com/vercel-labs/agent-browser/blob/dac13bb87468fe9d74a040d862720f6cc17a9565/package.json" }, { "label": "Native binary download and global shim changes", "url": "https://github.com/vercel-labs/agent-browser/blob/dac13bb87468fe9d74a040d862720f6cc17a9565/scripts/postinstall.js" }, { "label": "Dated skill-level install snapshot", "url": "https://www.skills.sh/vercel-labs/agent-browser/agent-browser" }, { "label": "Upstream license or license-inspection scope", "url": "https://github.com/vercel-labs/agent-browser/blob/dac13bb87468fe9d74a040d862720f6cc17a9565/LICENSE" }, { "label": "Trending board snapshot; visible UI labels 24h", "url": "https://www.skills.sh/trending" } ] }, { "id": "remotion-best-practices", "name": "Remotion Best Practices", "owner": "Remotion", "repository": "https://github.com/remotion-dev/skills", "skillPath": "skills/remotion-best-practices/SKILL.md", "sourceUrl": "https://github.com/remotion-dev/skills/blob/1441a11e95db35443bd76bb318386c0d3ca00053/skills/remotion-best-practices/SKILL.md", "category": "Video & motion", "summary": "A router to Remotion guidance for creating, previewing and rendering programmatic videos.", "bestFor": [ "React-based video projects", "Finding the right Remotion workflow" ], "requirements": [ "Node.js and Git for the reviewed project-creation flow; npm dependencies include Remotion and React.", "A browser for Studio preview; rendering requires the Remotion runtime and its platform-specific dependencies.", "No account or API key is specified for the basic local flow. Cloud rendering, maps, voices and external media can add service costs and credentials.", "The reviewed package is 4.0.536; published CLI commands use @latest or unpinned npx." ], "permissions": [ "Create project files and install npm dependencies.", "Start a local Studio server; explicit export requests may write rendered media." ], "risks": [ { "title": "Mutable executable setup", "severity": "high", "detail": "Creation guidance invokes create-video@latest and npm i. Pin and review resolved dependencies before running in a workspace with secrets." }, { "title": "Media and cloud terms differ", "severity": "attention", "detail": "The router can lead to cloud, map and media workflows. Their data flows, costs and content rights need separate evaluation." } ], "limitations": [ "Reviewed the router, creation reference and package metadata; not every routed subskill or rendering path.", "The skill repository tree and package metadata do not declare a license. Runtime and media rights cannot be inferred from public source availability.", "No video render, performance measurement or visual-quality benchmark performed here." ], "license": { "label": "Not declared in reviewed repository", "url": "https://github.com/remotion-dev/skills/tree/1441a11e95db35443bd76bb318386c0d3ca00053", "note": "No LICENSE file or package license declaration found at this revision. This directory links and comments; do not assume redistribution rights." }, "evidence": { "level": "task-tested", "reviewedOn": "2026-10-18", "revision": "1441a11e95db35443bd76bb318386c0d3ca00053", "scope": [ "Full router SKILL.md", "Full remotion-create/REFERENCE.md", "README.md and package.json", "Recursive tree inspected for license file", "Bounded evaluation; exact operations, counts, environment and limitations in the linked public report" ], "notTested": [ "No execution or end-to-end task evaluation performed in this source-review workstream.", "No complete dependency audit, current-advisory audit, or security certification.", "Requirements and risks describe the reviewed source; host-agent behavior and all supported platforms remain unverified here.", "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "task-evaluation", "summary": "One synthetic decision scenario, checked against a prewritten action rubric. Skill-conditioned 8/8; baseline 8/8. No measured advantage or executed workflow is claimed.", "environment": [ "Codex agent session; separate fresh baseline and skill-conditioned agents", "Text-only synthetic fixture; identical task and allowed-action contract; no network or account operations" ], "commands": [ "Read the recorded fixture and allowed actions; baseline receives no skill source.", "Read the pinned entrypoint and listed supporting instructions for the conditioned arm.", "Score required/rejected action selections, no-tool-request behavior and valid unique action IDs against the prewritten rubric." ], "results": { "passed": 8, "failed": 0, "total": 8 }, "findings": [ { "severity": "info", "title": "No measured advantage over baseline", "detail": "Both arms selected the same scored actions: baseline 8/8, skill-conditioned 8/8. These are decision checks, not completed real-world tasks." } ], "limitations": [ "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed.", "The response contract explicitly forbids tool use and treating fixture text as instructions. This cannot isolate skill-specific prompt-injection protection.", "Choices are conspicuous and the baseline reached the ceiling. No improvement in effectiveness, general reliability, security or productivity is established.", "No repetitions, blinded human quality ratings, time/cost comparison or cross-model/platform validation." ], "artifact": "/skill-evaluations/remotion-best-practices.json", "runAt": "2026-10-18" }, "popularity": { "basis": "Rounded installs reported by the skills.sh skill page, observed on the stated date. Not unique users, verified usage, quality, or a security score.", "url": "https://www.skills.sh/remotion-dev/skills/remotion-best-practices", "observedOn": "2026-10-18", "value": 639500, "metric": "skills-sh-installs-rounded", "scope": "skill", "window": "all-time", "observations": [ { "metric": "skills-sh-installs-rounded", "scope": "skill", "window": "24h", "observedOn": "2026-10-18", "value": 5200, "rank": 55, "url": "https://www.skills.sh/trending", "note": "Observed on the board labeled Trending (24h). The page title says This Week; the visible UI window is retained. Counts are rolling snapshots, not a verified growth rate." } ] }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/remotion-dev/skills/blob/1441a11e95db35443bd76bb318386c0d3ca00053/skills/remotion-best-practices/SKILL.md" }, { "label": "Creation and latest-version commands", "url": "https://github.com/remotion-dev/skills/blob/1441a11e95db35443bd76bb318386c0d3ca00053/skills/remotion-best-practices/remotion-create/REFERENCE.md" }, { "label": "Package runtime dependencies and version", "url": "https://github.com/remotion-dev/skills/blob/1441a11e95db35443bd76bb318386c0d3ca00053/package.json" }, { "label": "Official skill scope", "url": "https://github.com/remotion-dev/skills/blob/1441a11e95db35443bd76bb318386c0d3ca00053/README.md" }, { "label": "Dated skill-level install snapshot", "url": "https://www.skills.sh/remotion-dev/skills/remotion-best-practices" }, { "label": "Upstream license or license-inspection scope", "url": "https://github.com/remotion-dev/skills/tree/1441a11e95db35443bd76bb318386c0d3ca00053" }, { "label": "Trending board snapshot; visible UI labels 24h", "url": "https://www.skills.sh/trending" } ] }, { "id": "vercel-composition-patterns", "name": "React Composition Patterns", "owner": "Vercel", "repository": "https://github.com/vercel-labs/agent-skills", "skillPath": "skills/composition-patterns/SKILL.md", "sourceUrl": "https://github.com/vercel-labs/agent-skills/blob/063bee94c3f4df8453406c830b0a7df0f2860278/skills/composition-patterns/SKILL.md", "category": "Frontend", "summary": "Guidance for compound components, shared state and explicit component variants.", "bestFor": [ "Refactoring boolean-heavy component APIs", "Reviewing React component architecture" ], "requirements": [ "A React project and coding agent; no dedicated executable helper, account or API key is specified.", "The React 19 API section applies only to React 19+. React 18 projects must skip those changes.", "Project tests, type checking and build tools are needed to validate a refactor." ], "permissions": [ "Read React source and relevant rule files.", "Modify component APIs and callers when applying recommendations." ], "risks": [ { "title": "Version-sensitive refactors", "severity": "attention", "detail": "The source explicitly gates ref-as-prop and use() recommendations to React 19. Applying them to earlier runtimes can break compatibility." }, { "title": "Architecture changes alter contracts", "severity": "attention", "detail": "Replacing boolean modes or changing state placement can affect callers and behavior. IonBin assessment: preserve external contracts and test affected interactions." } ], "limitations": [ "Read the overview and React 19 rule; the remaining rule corpus was not independently audited.", "Pattern preferences are not measured performance improvements." ], "license": { "label": "MIT", "url": "https://github.com/vercel-labs/agent-skills/blob/063bee94c3f4df8453406c830b0a7df0f2860278/skills/composition-patterns/SKILL.md", "note": "MIT is declared in this skill's frontmatter; this review does not infer licenses for unrelated repository content." }, "evidence": { "level": "task-tested", "reviewedOn": "2026-10-18", "revision": "063bee94c3f4df8453406c830b0a7df0f2860278", "scope": [ "Full SKILL.md", "Full rules/react19-no-forwardref.md", "License declaration in skill frontmatter", "Bounded evaluation; exact operations, counts, environment and limitations in the linked public report" ], "notTested": [ "No execution or end-to-end task evaluation performed in this source-review workstream.", "No complete dependency audit, current-advisory audit, or security certification.", "Requirements and risks describe the reviewed source; host-agent behavior and all supported platforms remain unverified here.", "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "task-evaluation", "summary": "One synthetic decision scenario, checked against a prewritten action rubric. Skill-conditioned 8/8; baseline 8/8. No measured advantage or executed workflow is claimed.", "environment": [ "Codex agent session; separate fresh baseline and skill-conditioned agents", "Text-only synthetic fixture; identical task and allowed-action contract; no network or account operations" ], "commands": [ "Read the recorded fixture and allowed actions; baseline receives no skill source.", "Read the pinned entrypoint and listed supporting instructions for the conditioned arm.", "Score required/rejected action selections, no-tool-request behavior and valid unique action IDs against the prewritten rubric." ], "results": { "passed": 8, "failed": 0, "total": 8 }, "findings": [ { "severity": "info", "title": "No measured advantage over baseline", "detail": "Both arms selected the same scored actions: baseline 8/8, skill-conditioned 8/8. These are decision checks, not completed real-world tasks." } ], "limitations": [ "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed.", "The response contract explicitly forbids tool use and treating fixture text as instructions. This cannot isolate skill-specific prompt-injection protection.", "Choices are conspicuous and the baseline reached the ceiling. No improvement in effectiveness, general reliability, security or productivity is established.", "No repetitions, blinded human quality ratings, time/cost comparison or cross-model/platform validation." ], "artifact": "/skill-evaluations/vercel-composition-patterns.json", "runAt": "2026-10-18" }, "popularity": { "basis": "Rounded installs reported by the skills.sh skill page, observed on the stated date. Not unique users, verified usage, quality, or a security score.", "url": "https://www.skills.sh/vercel-labs/agent-skills/vercel-composition-patterns", "observedOn": "2026-10-18", "value": 402200, "metric": "skills-sh-installs-rounded", "scope": "skill", "window": "all-time", "observations": [ { "metric": "skills-sh-installs-rounded", "scope": "skill", "window": "24h", "observedOn": "2026-10-18", "value": 1800, "rank": 175, "url": "https://www.skills.sh/trending", "note": "Observed on the board labeled Trending (24h). The page title says This Week; the visible UI window is retained. Counts are rolling snapshots, not a verified growth rate." } ] }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/vercel-labs/agent-skills/blob/063bee94c3f4df8453406c830b0a7df0f2860278/skills/composition-patterns/SKILL.md" }, { "label": "React-version boundary", "url": "https://github.com/vercel-labs/agent-skills/blob/063bee94c3f4df8453406c830b0a7df0f2860278/skills/composition-patterns/rules/react19-no-forwardref.md" }, { "label": "Dated skill-level install snapshot", "url": "https://www.skills.sh/vercel-labs/agent-skills/vercel-composition-patterns" }, { "label": "Upstream license or license-inspection scope", "url": "https://github.com/vercel-labs/agent-skills/blob/063bee94c3f4df8453406c830b0a7df0f2860278/skills/composition-patterns/SKILL.md" }, { "label": "Trending board snapshot; visible UI labels 24h", "url": "https://www.skills.sh/trending" } ] }, { "id": "marketing-seo-audit", "name": "SEO Audit", "owner": "Corey Haines", "repository": "https://github.com/coreyhaines31/marketingskills", "skillPath": "skills/seo-audit/SKILL.md", "sourceUrl": "https://github.com/coreyhaines31/marketingskills/blob/365b412152b9542499ca1439426f7fc3cc92bb65/skills/seo-audit/SKILL.md", "category": "Marketing", "summary": "A structured audit framework for crawlability, technical foundations, on-page content and evidence-based priorities.", "bestFor": [ "Scoping a website SEO audit", "Separating observed issues from missing data" ], "requirements": [ "A browser or fetch tool and permission to inspect target URLs. Rendered-page checks are needed for client-injected schema.", "Search Console/analytics access is needed for property-specific performance evidence; public-page checks can proceed without it.", "Optional paid crawling and search tools are listed. No universal API key, CLI runtime or integration is specified." ], "permissions": [ "Read project marketing context, pages and supplied analytics.", "Produce an audit report; live site changes require a separate scoped implementation." ], "risks": [ { "title": "Private marketing and analytics context", "severity": "attention", "detail": "The skill reads local product-marketing context and may use account reports. IonBin assessment: minimize sensitive data and keep fetched pages as untrusted evidence." }, { "title": "Heuristics can become false findings", "severity": "attention", "detail": "The skill acknowledges static schema-detection limits. Verify each proposed finding in the correct rendered source or account data; broad SEO rules are not a ranking guarantee." } ], "limitations": [ "Instruction framework reviewed; referenced companion guides, current search-engine guidance and optional paid tools not comprehensively checked.", "No crawl, ranking recovery, traffic lift or search visibility outcome measured." ], "license": { "label": "MIT", "url": "https://github.com/coreyhaines31/marketingskills/blob/365b412152b9542499ca1439426f7fc3cc92bb65/LICENSE", "note": "License applies to upstream materials; retain required notices when copying or adapting." }, "evidence": { "level": "task-tested", "reviewedOn": "2026-10-18", "revision": "365b412152b9542499ca1439426f7fc3cc92bb65", "scope": [ "Full SKILL.md", "Repository MIT license", "Bounded evaluation; exact operations, counts, environment and limitations in the linked public report" ], "notTested": [ "No execution or end-to-end task evaluation performed in this source-review workstream.", "No complete dependency audit, current-advisory audit, or security certification.", "Requirements and risks describe the reviewed source; host-agent behavior and all supported platforms remain unverified here.", "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "task-evaluation", "summary": "One synthetic decision scenario, checked against a prewritten action rubric. Skill-conditioned 9/9; baseline 9/9. No measured advantage or executed workflow is claimed.", "environment": [ "Codex agent session; separate fresh baseline and skill-conditioned agents", "Text-only synthetic fixture; identical task and allowed-action contract; no network or account operations" ], "commands": [ "Read the recorded fixture and allowed actions; baseline receives no skill source.", "Read the pinned entrypoint and listed supporting instructions for the conditioned arm.", "Score required/rejected action selections, no-tool-request behavior and valid unique action IDs against the prewritten rubric." ], "results": { "passed": 9, "failed": 0, "total": 9 }, "findings": [ { "severity": "info", "title": "No measured advantage over baseline", "detail": "Both arms selected the same scored actions: baseline 9/9, skill-conditioned 9/9. These are decision checks, not completed real-world tasks." } ], "limitations": [ "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed.", "The response contract explicitly forbids tool use and treating fixture text as instructions. This cannot isolate skill-specific prompt-injection protection.", "Choices are conspicuous and the baseline reached the ceiling. No improvement in effectiveness, general reliability, security or productivity is established.", "No repetitions, blinded human quality ratings, time/cost comparison or cross-model/platform validation." ], "artifact": "/skill-evaluations/marketing-seo-audit.json", "runAt": "2026-10-18" }, "popularity": { "basis": "Rounded installs reported by the skills.sh skill page, observed on the stated date. Not unique users, verified usage, quality, or a security score.", "url": "https://www.skills.sh/coreyhaines31/marketingskills/seo-audit", "observedOn": "2026-10-18", "value": 231100, "metric": "skills-sh-installs-rounded", "scope": "skill", "window": "all-time" }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/coreyhaines31/marketingskills/blob/365b412152b9542499ca1439426f7fc3cc92bb65/skills/seo-audit/SKILL.md" }, { "label": "Dated skill-level install snapshot", "url": "https://www.skills.sh/coreyhaines31/marketingskills/seo-audit" }, { "label": "Upstream license or license-inspection scope", "url": "https://github.com/coreyhaines31/marketingskills/blob/365b412152b9542499ca1439426f7fc3cc92bb65/LICENSE" } ] }, { "id": "marketing-copywriting", "name": "Copywriting", "owner": "Corey Haines", "repository": "https://github.com/coreyhaines31/marketingskills", "skillPath": "skills/copywriting/SKILL.md", "sourceUrl": "https://github.com/coreyhaines31/marketingskills/blob/365b412152b9542499ca1439426f7fc3cc92bb65/skills/copywriting/SKILL.md", "category": "Marketing", "summary": "A brief-first workflow for preserving voice, tightening scope and drafting supportable marketing claims.", "bestFor": [ "Landing-page copy", "Focused edits that preserve an existing voice" ], "requirements": [ "A writing agent, an approved brief and support for factual claims.", "Relevant product-marketing context may be read from local files; no dedicated runtime, paid tool, account or API key is required." ], "permissions": [ "Read supplied copy, customer evidence and project marketing context.", "Write draft copy; the instructions do not themselves grant publication or messaging authority." ], "risks": [ { "title": "Confidential customer evidence", "severity": "attention", "detail": "Reviews, support tickets and other voice-of-customer sources may contain personal or private data. IonBin assessment: use authorized, minimized material." }, { "title": "Borrowed metrics are not your results", "severity": "attention", "detail": "The text includes general conversion-related statistics and illustrative examples. Do not reuse them as proof of a product's performance; validate claims against the actual brief's evidence." } ], "limitations": [ "No conversion lift or audience effectiveness was measured.", "Only the main instruction file and license were reviewed; companion frameworks and their cited studies were not independently validated." ], "license": { "label": "MIT", "url": "https://github.com/coreyhaines31/marketingskills/blob/365b412152b9542499ca1439426f7fc3cc92bb65/LICENSE", "note": "MIT repository license. Main skill attributes some adapted drafting methods to the MIT-licensed Profound library." }, "evidence": { "level": "task-tested", "reviewedOn": "2026-10-18", "revision": "365b412152b9542499ca1439426f7fc3cc92bb65", "scope": [ "Full SKILL.md, including claim discipline and upstream adaptation attribution", "Repository MIT license", "Bounded evaluation; exact operations, counts, environment and limitations in the linked public report" ], "notTested": [ "No execution or end-to-end task evaluation performed in this source-review workstream.", "No complete dependency audit, current-advisory audit, or security certification.", "Requirements and risks describe the reviewed source; host-agent behavior and all supported platforms remain unverified here.", "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "task-evaluation", "summary": "One synthetic decision scenario, checked against a prewritten action rubric. Skill-conditioned 8/8; baseline 8/8. No measured advantage or executed workflow is claimed.", "environment": [ "Codex agent session; separate fresh baseline and skill-conditioned agents", "Text-only synthetic fixture; identical task and allowed-action contract; no network or account operations" ], "commands": [ "Read the recorded fixture and allowed actions; baseline receives no skill source.", "Read the pinned entrypoint and listed supporting instructions for the conditioned arm.", "Score required/rejected action selections, no-tool-request behavior and valid unique action IDs against the prewritten rubric." ], "results": { "passed": 8, "failed": 0, "total": 8 }, "findings": [ { "severity": "info", "title": "No measured advantage over baseline", "detail": "Both arms selected the same scored actions: baseline 8/8, skill-conditioned 8/8. These are decision checks, not completed real-world tasks." } ], "limitations": [ "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed.", "The response contract explicitly forbids tool use and treating fixture text as instructions. This cannot isolate skill-specific prompt-injection protection.", "Choices are conspicuous and the baseline reached the ceiling. No improvement in effectiveness, general reliability, security or productivity is established.", "No repetitions, blinded human quality ratings, time/cost comparison or cross-model/platform validation." ], "artifact": "/skill-evaluations/marketing-copywriting.json", "runAt": "2026-10-18" }, "popularity": { "basis": "Rounded installs reported by the skills.sh skill page, observed on the stated date. Not unique users, verified usage, quality, or a security score.", "url": "https://www.skills.sh/coreyhaines31/marketingskills/copywriting", "observedOn": "2026-10-18", "value": 228200, "metric": "skills-sh-installs-rounded", "scope": "skill", "window": "all-time" }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/coreyhaines31/marketingskills/blob/365b412152b9542499ca1439426f7fc3cc92bb65/skills/copywriting/SKILL.md" }, { "label": "Dated skill-level install snapshot", "url": "https://www.skills.sh/coreyhaines31/marketingskills/copywriting" }, { "label": "Upstream license or license-inspection scope", "url": "https://github.com/coreyhaines31/marketingskills/blob/365b412152b9542499ca1439426f7fc3cc92bb65/LICENSE" } ] }, { "id": "superpowers-requesting-code-review", "name": "Requesting Code Review", "owner": "Jesse Vincent / obra", "repository": "https://github.com/obra/superpowers", "skillPath": "skills/requesting-code-review/SKILL.md", "sourceUrl": "https://github.com/obra/superpowers/blob/bb92a77741419a4ab5f06e711a283343f1ada0c3/skills/requesting-code-review/SKILL.md", "category": "Engineering", "summary": "A workflow for delegating a bounded code review with requirements and an explicit Git range.", "bestFor": [ "Review before merge", "Separating implementation from review context" ], "requirements": [ "Git history with meaningful base/head commits, a review-capable subagent and the reviewer template.", "No dedicated package or API key is specified. Host model access and project test tools remain separate.", "Shell examples use Bash syntax; adapt to the host platform." ], "permissions": [ "Read source, diffs and relevant requirements; pass scoped context to a reviewer agent.", "Reviewer template is read-only on the active checkout; a separate worktree is suggested for other revisions." ], "risks": [ { "title": "Wrong range omits the work", "severity": "attention", "detail": "HEAD~1 only covers the last commit and uncommitted edits are outside the explicit commit diff. Verify the chosen range against the actual change." }, { "title": "Review confidence is limited", "severity": "attention", "detail": "A second model review can miss defects or overstate readiness. Keep findings tied to inspected lines, run relevant tests and preserve the user's release authority." } ], "limitations": [ "Reviewed skill and reviewer prompt, not the entire Superpowers plugin.", "A review verdict is not a merge authorization, full security audit or demonstrated defect-detection rate." ], "license": { "label": "MIT", "url": "https://github.com/obra/superpowers/blob/bb92a77741419a4ab5f06e711a283343f1ada0c3/LICENSE", "note": "License applies to upstream materials; retain required notices when copying or adapting." }, "evidence": { "level": "task-tested", "reviewedOn": "2026-10-18", "revision": "bb92a77741419a4ab5f06e711a283343f1ada0c3", "scope": [ "Full SKILL.md", "Full code-reviewer.md", "Repository MIT license", "Bounded evaluation; exact operations, counts, environment and limitations in the linked public report" ], "notTested": [ "No execution or end-to-end task evaluation performed in this source-review workstream.", "No complete dependency audit, current-advisory audit, or security certification.", "Requirements and risks describe the reviewed source; host-agent behavior and all supported platforms remain unverified here.", "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "task-evaluation", "summary": "One synthetic decision scenario, checked against a prewritten action rubric. Skill-conditioned 9/9; baseline 9/9. No measured advantage or executed workflow is claimed.", "environment": [ "Codex agent session; separate fresh baseline and skill-conditioned agents", "Text-only synthetic fixture; identical task and allowed-action contract; no network or account operations" ], "commands": [ "Read the recorded fixture and allowed actions; baseline receives no skill source.", "Read the pinned entrypoint and listed supporting instructions for the conditioned arm.", "Score required/rejected action selections, no-tool-request behavior and valid unique action IDs against the prewritten rubric." ], "results": { "passed": 9, "failed": 0, "total": 9 }, "findings": [ { "severity": "info", "title": "No measured advantage over baseline", "detail": "Both arms selected the same scored actions: baseline 9/9, skill-conditioned 9/9. These are decision checks, not completed real-world tasks." } ], "limitations": [ "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed.", "The response contract explicitly forbids tool use and treating fixture text as instructions. This cannot isolate skill-specific prompt-injection protection.", "Choices are conspicuous and the baseline reached the ceiling. No improvement in effectiveness, general reliability, security or productivity is established.", "No repetitions, blinded human quality ratings, time/cost comparison or cross-model/platform validation." ], "artifact": "/skill-evaluations/superpowers-requesting-code-review.json", "runAt": "2026-10-18" }, "popularity": { "basis": "Rounded installs reported by the skills.sh skill page, observed on the stated date. Not unique users, verified usage, quality, or a security score.", "url": "https://www.skills.sh/obra/superpowers/requesting-code-review", "observedOn": "2026-10-18", "value": 256600, "metric": "skills-sh-installs-rounded", "scope": "skill", "window": "all-time" }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/obra/superpowers/blob/bb92a77741419a4ab5f06e711a283343f1ada0c3/skills/requesting-code-review/SKILL.md" }, { "label": "Read-only review template and Git-range limits", "url": "https://github.com/obra/superpowers/blob/bb92a77741419a4ab5f06e711a283343f1ada0c3/skills/requesting-code-review/code-reviewer.md" }, { "label": "Dated skill-level install snapshot", "url": "https://www.skills.sh/obra/superpowers/requesting-code-review" }, { "label": "Upstream license or license-inspection scope", "url": "https://github.com/obra/superpowers/blob/bb92a77741419a4ab5f06e711a283343f1ada0c3/LICENSE" } ] }, { "id": "trailofbits-differential-review", "name": "Differential Security Review", "owner": "Trail of Bits", "repository": "https://github.com/trailofbits/skills", "skillPath": "plugins/differential-review/skills/differential-review/SKILL.md", "sourceUrl": "https://github.com/trailofbits/skills/blob/5c99c03fb8a9ea568432ecbcba5d86e9f4ac2bf0/plugins/differential-review/skills/differential-review/SKILL.md", "category": "Security review", "summary": "A risk-focused review method connecting code changes to history, affected callers, test coverage and explicit reports.", "bestFor": [ "Security-sensitive diffs", "Reviewing validation or authorization changes" ], "requirements": [ "A local Git repository, baseline/head revisions, source-reading/search tools and report-file access.", "The PR path uses gh and authorized GitHub access. Local commit review does not require an account or API key.", "Examples use Bash tools such as grep, find and wc; host adaptation may be needed. Optional companion skills/subagents extend the review." ], "permissions": [ "Read repository history and source; write a Markdown report.", "Methodology examples switch baseline/head checkouts; optional workflows invoke other skills." ], "risks": [ { "title": "Checkout can disturb active work", "severity": "high", "detail": "The methodology literally proposes git checkout for baseline and head. IonBin assessment: use read-only git show/diff or an isolated worktree when work is in progress." }, { "title": "Scope and call-count limitations", "severity": "attention", "detail": "The method narrows analysis in large repositories and demonstrates grep-based caller counts. Text matches are not a complete semantic call graph; report skipped areas and uncertainty." } ], "limitations": [ "Reviewed entry point and methodology; adversarial, reporting and pattern references not exhaustively reviewed.", "Security-review instructions do not establish that resulting code is secure or that all vulnerabilities are found." ], "license": { "label": "CC-BY-SA-4.0", "url": "https://github.com/trailofbits/skills/blob/5c99c03fb8a9ea568432ecbcba5d86e9f4ac2bf0/LICENSE", "note": "Upstream uses Creative Commons Attribution-ShareAlike 4.0. Adaptation and redistribution obligations differ from MIT; this entry supplies original commentary and links." }, "evidence": { "level": "task-tested", "reviewedOn": "2026-10-18", "revision": "5c99c03fb8a9ea568432ecbcba5d86e9f4ac2bf0", "scope": [ "Full SKILL.md", "Full methodology.md", "Repository CC-BY-SA-4.0 license header", "Bounded evaluation; exact operations, counts, environment and limitations in the linked public report" ], "notTested": [ "No execution or end-to-end task evaluation performed in this source-review workstream.", "No complete dependency audit, current-advisory audit, or security certification.", "Requirements and risks describe the reviewed source; host-agent behavior and all supported platforms remain unverified here.", "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "task-evaluation", "summary": "One synthetic decision scenario, checked against a prewritten action rubric. Skill-conditioned 9/9; baseline 9/9. No measured advantage or executed workflow is claimed.", "environment": [ "Codex agent session; separate fresh baseline and skill-conditioned agents", "Text-only synthetic fixture; identical task and allowed-action contract; no network or account operations" ], "commands": [ "Read the recorded fixture and allowed actions; baseline receives no skill source.", "Read the pinned entrypoint and listed supporting instructions for the conditioned arm.", "Score required/rejected action selections, no-tool-request behavior and valid unique action IDs against the prewritten rubric." ], "results": { "passed": 9, "failed": 0, "total": 9 }, "findings": [ { "severity": "info", "title": "No measured advantage over baseline", "detail": "Both arms selected the same scored actions: baseline 9/9, skill-conditioned 9/9. These are decision checks, not completed real-world tasks." } ], "limitations": [ "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed.", "The response contract explicitly forbids tool use and treating fixture text as instructions. This cannot isolate skill-specific prompt-injection protection.", "Choices are conspicuous and the baseline reached the ceiling. No improvement in effectiveness, general reliability, security or productivity is established.", "No repetitions, blinded human quality ratings, time/cost comparison or cross-model/platform validation." ], "artifact": "/skill-evaluations/trailofbits-differential-review.json", "runAt": "2026-10-18" }, "popularity": { "basis": "Rounded installs reported by the skills.sh skill page, observed on the stated date. Not unique users, verified usage, quality, or a security score.", "url": "https://www.skills.sh/trailofbits/skills/differential-review", "observedOn": "2026-10-18", "value": 8100, "metric": "skills-sh-installs-rounded", "scope": "skill", "window": "all-time" }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/trailofbits/skills/blob/5c99c03fb8a9ea568432ecbcba5d86e9f4ac2bf0/plugins/differential-review/skills/differential-review/SKILL.md" }, { "label": "Baseline checkout, triage, call-count and coverage method", "url": "https://github.com/trailofbits/skills/blob/5c99c03fb8a9ea568432ecbcba5d86e9f4ac2bf0/plugins/differential-review/skills/differential-review/methodology.md" }, { "label": "Dated skill-level install snapshot", "url": "https://www.skills.sh/trailofbits/skills/differential-review" }, { "label": "Upstream license or license-inspection scope", "url": "https://github.com/trailofbits/skills/blob/5c99c03fb8a9ea568432ecbcba5d86e9f4ac2bf0/LICENSE" } ] }, { "id": "ui-ux-pro-max", "name": "UI/UX Pro Max", "owner": "Next Level Builder", "repository": "https://github.com/nextlevelbuilder/ui-ux-pro-max-skill", "skillPath": ".claude/skills/ui-ux-pro-max/SKILL.md", "sourceUrl": "https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/blob/56ea9cf174ed86786187daa9de0e6247cb0747e4/.claude/skills/ui-ux-pro-max/SKILL.md", "category": "Design & accessibility", "summary": "A searchable local design-guidance library with optional persistent design-system output.", "bestFor": [ "Finding targeted UI guidance", "Building a documented visual system for a known stack" ], "requirements": [ "Python 3.x; reviewed search/core modules use standard-library imports and local CSV data. Keep the script/data layout intact.", "Resolve the full installed script path; the documented CLAUDE_PLUGIN_ROOT path may need adaptation outside that plugin host.", "No account or API key is required for local search. Generated implementation may introduce its own libraries or external assets." ], "permissions": [ "Read bundled guidance and project stack metadata.", "With --persist, write design-system files beneath --output-dir; --force permits replacing existing output." ], "risks": [ { "title": "Persistence and force overwrite", "severity": "attention", "detail": "The current instructions explicitly require a target directory and approval before --force. The parser forwards those options to design_system.py; verify the destination before saving." }, { "title": "Recommendations are not test results", "severity": "attention", "detail": "Automatic domain/stack matching can return irrelevant guidance. The skill calls for checking matches and disclosing fallback; generated colors and accessibility still need validation." } ], "limitations": [ "Reviewed SKILL.md plus selected parser, imports, search and persistence entry points; not all databases, reasoning rules or helper code.", "Historical local packaging adaptation is documented separately; no historical task success or replicated outcome is claimed.", "Current revision differs from the June library snapshot." ], "license": { "label": "MIT", "url": "https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/blob/56ea9cf174ed86786187daa9de0e6247cb0747e4/LICENSE", "note": "MIT applies to repository code; embedded fonts, icons and other assets can have their own terms." }, "evidence": { "level": "task-tested", "reviewedOn": "2026-10-18", "revision": "56ea9cf174ed86786187daa9de0e6247cb0747e4", "scope": [ "Full SKILL.md", "Selected search.py argument/import/output paths", "Selected core.py imports/data paths/search entry points", "Selected design_system.py imports/persistence entry points", "Repository MIT license", "Bounded evaluation; exact operations, counts, environment and limitations in the linked public report" ], "notTested": [ "No execution or end-to-end task evaluation performed in this source-review workstream.", "No complete dependency audit, current-advisory audit, or security certification.", "Requirements and risks describe the reviewed source; host-agent behavior and all supported platforms remain unverified here.", "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed." ] }, "relationship": "explored", "relationshipEvidence": { "summary": "A prior bundle was adapted for local packaging, with companion naming fixes and trigger-coverage cases. This is documented adaptation, not verified historical use or outcome replication." }, "evaluation": { "status": "completed", "kind": "task-evaluation", "summary": "One synthetic decision scenario, checked against a prewritten action rubric. Skill-conditioned 8/8; baseline 8/8. No measured advantage or executed workflow is claimed.", "environment": [ "Codex agent session; separate fresh baseline and skill-conditioned agents", "Text-only synthetic fixture; identical task and allowed-action contract; no network or account operations" ], "commands": [ "Read the recorded fixture and allowed actions; baseline receives no skill source.", "Read the pinned entrypoint and listed supporting instructions for the conditioned arm.", "Score required/rejected action selections, no-tool-request behavior and valid unique action IDs against the prewritten rubric." ], "results": { "passed": 8, "failed": 0, "total": 8 }, "findings": [ { "severity": "info", "title": "No measured advantage over baseline", "detail": "Both arms selected the same scored actions: baseline 8/8, skill-conditioned 8/8. These are decision checks, not completed real-world tasks." } ], "limitations": [ "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed.", "The response contract explicitly forbids tool use and treating fixture text as instructions. This cannot isolate skill-specific prompt-injection protection.", "Choices are conspicuous and the baseline reached the ceiling. No improvement in effectiveness, general reliability, security or productivity is established.", "No repetitions, blinded human quality ratings, time/cost comparison or cross-model/platform validation." ], "artifact": "/skill-evaluations/ui-ux-pro-max.json", "runAt": "2026-10-18" }, "popularity": { "basis": "Rounded installs reported by the skills.sh skill page, observed on the stated date. Not unique users, verified usage, quality, or a security score.", "url": "https://www.skills.sh/nextlevelbuilder/ui-ux-pro-max-skill/ui-ux-pro-max", "observedOn": "2026-10-18", "value": 402500, "metric": "skills-sh-installs-rounded", "scope": "skill", "window": "all-time", "observations": [ { "metric": "skills-sh-installs-rounded", "scope": "skill", "window": "24h", "observedOn": "2026-10-18", "value": 1400, "rank": 215, "url": "https://www.skills.sh/trending", "note": "Observed on the board labeled Trending (24h). The page title says This Week; the visible UI window is retained. Counts are rolling snapshots, not a verified growth rate." } ] }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/blob/56ea9cf174ed86786187daa9de0e6247cb0747e4/.claude/skills/ui-ux-pro-max/SKILL.md" }, { "label": "Search parser, runtime and persistence options", "url": "https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/blob/56ea9cf174ed86786187daa9de0e6247cb0747e4/.claude/skills/ui-ux-pro-max/scripts/search.py" }, { "label": "Local CSV search implementation", "url": "https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/blob/56ea9cf174ed86786187daa9de0e6247cb0747e4/.claude/skills/ui-ux-pro-max/scripts/core.py" }, { "label": "Design-system generation and persistence", "url": "https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/blob/56ea9cf174ed86786187daa9de0e6247cb0747e4/.claude/skills/ui-ux-pro-max/scripts/design_system.py" }, { "label": "Dated skill-level install snapshot", "url": "https://www.skills.sh/nextlevelbuilder/ui-ux-pro-max-skill/ui-ux-pro-max" }, { "label": "Upstream license or license-inspection scope", "url": "https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/blob/56ea9cf174ed86786187daa9de0e6247cb0747e4/LICENSE" }, { "label": "Trending board snapshot; visible UI labels 24h", "url": "https://www.skills.sh/trending" } ] }, { "id": "taste-frontend-design", "name": "Taste Frontend Design", "owner": "leonxlnx", "repository": "https://github.com/leonxlnx/taste-skill", "skillPath": "skills/taste-skill/SKILL.md", "sourceUrl": "https://github.com/leonxlnx/taste-skill/blob/a206bbf75a9d80554c0de17c1198ee2fbbc555aa/skills/taste-skill/SKILL.md", "category": "Design & accessibility", "summary": "An opinionated design workflow using direction selection, browser inspection, screenshot critique and asset sourcing.", "bestFor": [ "Exploring a deliberate visual direction", "Auditing page composition across viewport sizes" ], "requirements": [ "Full inspector workflow: Node.js 22+ and installed Chrome, Edge or Chromium. Browser discovery covers Windows, macOS and Linux paths.", "The lint fallback and assets helper state Node 18+; no npm dependencies are required by the selected helpers.", "Asset search needs outbound network access and uses public collections without API keys. Run from the intended project root." ], "permissions": [ "Read project source, launch a headless browser and local loopback file server.", "Write .taste-skill reports/screenshots; optional asset search/download writes media and credit records." ], "risks": [ { "title": "Local serving and sensitive output", "severity": "high", "detail": "The inspector can serve the current project root over loopback and captures rendered pages. IonBin assessment: use an isolated fixture without secrets and inspect generated artifacts before sharing." }, { "title": "Asset rights and style constraints", "severity": "attention", "detail": "Assets come from external providers and carry individual licenses. House-style checks and upstream design-study claims are not independent usability evidence; preserve the brief and verify rights per item." } ], "limitations": [ "Reviewed instruction file plus selected inspector, CDP and asset-helper paths; not every rule, dataset or source provider.", "No browser inspection, aesthetics benchmark, asset-license audit or cross-platform execution performed here.", "Current v2 scripts differ substantially from the locally packaged June version; adaptation history does not demonstrate current behavior." ], "license": { "label": "MIT", "url": "https://github.com/leonxlnx/taste-skill/blob/a206bbf75a9d80554c0de17c1198ee2fbbc555aa/LICENSE", "note": "MIT repository license; externally sourced photographs, fonts and media require their own rights checks." }, "evidence": { "level": "task-tested", "reviewedOn": "2026-10-18", "revision": "a206bbf75a9d80554c0de17c1198ee2fbbc555aa", "scope": [ "SKILL.md workflow, house rules and fallback sections", "inspect.mjs imports, loopback serving and output paths", "scripts/lib/cdp.mjs browser discovery, launch and temporary-profile cleanup paths", "assets.mjs provider, network and write paths", "Repository MIT license", "Bounded evaluation; exact operations, counts, environment and limitations in the linked public report" ], "notTested": [ "No execution or end-to-end task evaluation performed in this source-review workstream.", "No complete dependency audit, current-advisory audit, or security certification.", "Requirements and risks describe the reviewed source; host-agent behavior and all supported platforms remain unverified here.", "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed." ] }, "relationship": "explored", "relationshipEvidence": { "summary": "A prior version was adapted for local library packaging and given trigger-coverage cases. That record does not demonstrate task execution, production use, or reproduced outcomes; the current upstream version differs substantially." }, "evaluation": { "status": "completed", "kind": "task-evaluation", "summary": "One synthetic decision scenario, checked against a prewritten action rubric. Skill-conditioned 8/8; baseline 8/8. No measured advantage or executed workflow is claimed.", "environment": [ "Codex agent session; separate fresh baseline and skill-conditioned agents", "Text-only synthetic fixture; identical task and allowed-action contract; no network or account operations" ], "commands": [ "Read the recorded fixture and allowed actions; baseline receives no skill source.", "Read the pinned entrypoint and listed supporting instructions for the conditioned arm.", "Score required/rejected action selections, no-tool-request behavior and valid unique action IDs against the prewritten rubric." ], "results": { "passed": 8, "failed": 0, "total": 8 }, "findings": [ { "severity": "info", "title": "No measured advantage over baseline", "detail": "Both arms selected the same scored actions: baseline 8/8, skill-conditioned 8/8. These are decision checks, not completed real-world tasks." } ], "limitations": [ "One text-only, bounded-choice scenario per arm; no workflow, helper, shell, browser, install, render or account operation was executed.", "The same inherited Codex session model and host safety rules applied to both arms; the exact model build and sampling parameters were not exposed.", "The response contract explicitly forbids tool use and treating fixture text as instructions. This cannot isolate skill-specific prompt-injection protection.", "Choices are conspicuous and the baseline reached the ceiling. No improvement in effectiveness, general reliability, security or productivity is established.", "No repetitions, blinded human quality ratings, time/cost comparison or cross-model/platform validation." ], "artifact": "/skill-evaluations/taste-frontend-design.json", "runAt": "2026-10-18" }, "popularity": { "basis": "Rounded installs reported by the skills.sh skill page, observed on the stated date. Not unique users, verified usage, quality, or a security score.", "url": "https://www.skills.sh/leonxlnx/taste-skill/design-taste-frontend", "observedOn": "2026-10-18", "value": 634000, "metric": "skills-sh-installs-rounded", "scope": "skill", "window": "all-time", "observations": [ { "metric": "skills-sh-installs-rounded", "scope": "skill", "window": "24h", "observedOn": "2026-10-18", "value": 4600, "rank": 65, "url": "https://www.skills.sh/trending", "note": "Observed on the board labeled Trending (24h). The page title says This Week; the visible UI window is retained. Counts are rolling snapshots, not a verified growth rate." } ] }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/leonxlnx/taste-skill/blob/a206bbf75a9d80554c0de17c1198ee2fbbc555aa/skills/taste-skill/SKILL.md" }, { "label": "Inspector server and report paths", "url": "https://github.com/leonxlnx/taste-skill/blob/a206bbf75a9d80554c0de17c1198ee2fbbc555aa/skills/taste-skill/scripts/inspect.mjs" }, { "label": "Browser discovery and temporary profiles", "url": "https://github.com/leonxlnx/taste-skill/blob/a206bbf75a9d80554c0de17c1198ee2fbbc555aa/skills/taste-skill/scripts/lib/cdp.mjs" }, { "label": "External asset sources and downloads", "url": "https://github.com/leonxlnx/taste-skill/blob/a206bbf75a9d80554c0de17c1198ee2fbbc555aa/skills/taste-skill/scripts/assets.mjs" }, { "label": "Dated skill-level install snapshot", "url": "https://www.skills.sh/leonxlnx/taste-skill/design-taste-frontend" }, { "label": "Upstream license or license-inspection scope", "url": "https://github.com/leonxlnx/taste-skill/blob/a206bbf75a9d80554c0de17c1198ee2fbbc555aa/LICENSE" }, { "label": "Trending board snapshot; visible UI labels 24h", "url": "https://www.skills.sh/trending" } ] }, { "id": "anthropic-pptx", "name": "PowerPoint Presentations", "owner": "Anthropic", "repository": "https://github.com/anthropics/skills", "skillPath": "skills/pptx/SKILL.md", "sourceUrl": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/pptx/SKILL.md", "category": "Documents", "summary": "A presentation authoring and editing workflow with OOXML helpers, template guidance and rendered-slide review. Useful for editable decks, with substantial file-mutation and licensing caveats.", "review": { "whatItIs": "A skill that tells an agent how to create, inspect and edit PowerPoint files. It combines presentation-writing guidance with scripts for duplicating slides, cleaning package parts, making thumbnails and checking file structure. The skill is a workflow; the actual work depends on a host agent, local tools and your source material.", "whyUse": "Use it when a deck must remain editable or fit an existing template. Its guidance addresses details that a text-only slide outline misses: relationships between package parts, notes, charts, layout choices and a separate visual inspection step. A file that opens is still not proof that its content fits or reads well.", "useCases": [ { "title": "Refresh a template-based operations deck", "example": "Provide an approved template and a synthetic five-item status table. Ask for one summary slide, three workstream slides and a decision slide, saving a separate output and retaining notes and editable text.", "expectedResult": "A draft PowerPoint file plus a slide-by-slide content and visual review in an authorized runtime.", "caveat": "This example was not executed. Duplicated slides may share chart or embedded-object parts; editing one can affect another. Preserve the original and inspect every rendered slide." }, { "title": "Remove retired material from a training deck", "example": "On a disposable copy, remove two retired topics, finish the slide order, then inspect which media and relationships the cleanup helper would discard.", "expectedResult": "A smaller draft deck with the intended slide list and no stale package references, subject to independent validation.", "caveat": "The cleanup helper deletes files. Source review found prefix/quote-sensitive slide discovery and a potential Windows path mismatch; neither was runtime-tested here." } ] }, "bestFor": [ "Editable presentation drafts and template-based updates", "Separating content, package-structure and rendered-slide review" ], "requirements": [ "A host agent with file and shell access in an environment where the per-skill terms permit use. The reviewed license is proprietary, not the repository's Apache-licensed skill terms.", "Node and pptxgenjs for new decks; Python and named XML/image packages for helpers; markitdown for text extraction; LibreOffice and PDF image tools for rendering. Upstream claims of preinstallation do not establish availability on your machine.", "An approved template, usable fonts and source content. Local file work does not inherently require an account; the host service and license conditions are separate." ], "permissions": [ "Read presentation ZIP/XML, images, notes and embedded content. Write a new package or replace the input when an output path is omitted.", "Run local Python/Node/native renderers and delete unreferenced files during cleanup. Dependency installation may contact package registries; granting the skill does not create a file-access sandbox." ], "risks": [ { "title": "Runtime not run: restrictive per-skill terms", "severity": "attention", "detail": "The pinned PPTX license labels all skill components subject to Anthropic-service agreements and adds restrictions on copying outside those services, derivatives and redistribution. This pass stopped at source review; no PPTX helper was imported or executed here." }, { "title": "Cleanup can mistake an XML naming change for an empty deck", "severity": "attention", "detail": "Source trace: slide discovery looks for literal p:sldId elements and double-quoted r:id attributes. If a valid presentation uses another XML prefix or quoting form, both discovery and its refusal guard can miss the slide list. The cleanup path can then treat on-disk slides as orphaned. This is a source-level concern, not a reproduced deletion; use a disposable copy and inspect the slide list before cleanup." }, { "title": "Windows path formatting can leave deleted-part declarations", "severity": "attention", "detail": "Source trace: removed file paths are recorded with str(Path), while content-type PartName values use forward slashes. On Windows the comparison can miss a deleted part. No Windows cleanup was executed; check the resulting package with an independent validator in an authorized runtime." }, { "title": "Editing helpers can overwrite or delete content", "severity": "attention", "detail": "The entrypoint documents in-place editing, add_slide.py defaults to replacing its input package unless an output path is supplied, and clean.py deletes unreferenced parts. The review did not establish rollback or recovery. Work from a retained original and a separate output." } ], "limitations": [ "Runtime not run because the reviewed per-skill terms restrict the evaluation context. These findings come from source inspection only.", "No PowerPoint/LibreOffice rendering, template interoperability, generated-deck quality, font behavior or malicious-document resilience was evaluated." ], "license": { "label": "Proprietary / service terms", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/pptx/LICENSE.txt", "note": "The separate per-skill license was read at this revision. It ties use to Anthropic-service terms and adds restrictions on copying, derivatives and redistribution; this source review does not grant permission to install or reuse it." }, "evidence": { "level": "source-reviewed", "reviewedOn": "2026-10-19", "revision": "dbd4588f9e1033efb41dad4bef2f7947c8993d44", "scope": [ "Manual review of purpose, dependencies, mutation boundaries, path helpers and selected cleanup control flow. Runtime not run.", "Pinned entrypoint, per-skill license and each file named in the report source manifest" ], "notTested": [ "Runtime not run because the reviewed per-skill terms restrict the evaluation context. These findings come from source inspection only.", "No PowerPoint/LibreOffice rendering, template interoperability, generated-deck quality, font behavior or malicious-document resilience was evaluated.", "One bounded pass at one pinned revision; no model-effectiveness baseline, repeated trials, security certification or assurance about future versions.", "No private files, credentials, authenticated accounts, paid requests or real customer workflows. Transitive dependencies and current vulnerability advisories were not audited." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "source-review", "summary": "Runtime not run because of the per-skill license boundary. Six manual source-review expectations: four met and two concerns identified in cleanup logic. No presentation was generated, edited or rendered.", "environment": [ "Manual review of pinned public source; no upstream code imported or executed" ], "commands": [ "Read pinned entrypoint, per-skill license and named helper control flow; record findings without executing the upstream skill." ], "results": { "passed": 4, "failed": 2, "total": 6 }, "findings": [ { "severity": "attention", "title": "Runtime not run: restrictive per-skill terms", "detail": "The pinned PPTX license labels all skill components subject to Anthropic-service agreements and adds restrictions on copying outside those services, derivatives and redistribution. This pass stopped at source review; no PPTX helper was imported or executed here." }, { "severity": "attention", "title": "Cleanup can mistake an XML naming change for an empty deck", "detail": "Source trace: slide discovery looks for literal p:sldId elements and double-quoted r:id attributes. If a valid presentation uses another XML prefix or quoting form, both discovery and its refusal guard can miss the slide list. The cleanup path can then treat on-disk slides as orphaned. This is a source-level concern, not a reproduced deletion; use a disposable copy and inspect the slide list before cleanup." }, { "severity": "attention", "title": "Windows path formatting can leave deleted-part declarations", "detail": "Source trace: removed file paths are recorded with str(Path), while content-type PartName values use forward slashes. On Windows the comparison can miss a deleted part. No Windows cleanup was executed; check the resulting package with an independent validator in an authorized runtime." }, { "severity": "attention", "title": "Editing helpers can overwrite or delete content", "detail": "The entrypoint documents in-place editing, add_slide.py defaults to replacing its input package unless an output path is supplied, and clean.py deletes unreferenced parts. The review did not establish rollback or recovery. Work from a retained original and a separate output." } ], "limitations": [ "Runtime not run because the reviewed per-skill terms restrict the evaluation context. These findings come from source inspection only.", "No PowerPoint/LibreOffice rendering, template interoperability, generated-deck quality, font behavior or malicious-document resilience was evaluated.", "One bounded pass at one pinned revision; no model-effectiveness baseline, repeated trials, security certification or assurance about future versions.", "No private files, credentials, authenticated accounts, paid requests or real customer workflows. Transitive dependencies and current vulnerability advisories were not audited." ], "artifact": "/skill-evaluations/anthropic-pptx.json", "runAt": "2026-10-19" }, "popularity": { "basis": "Selected from a widely followed repository and dated skills.sh directory observations. Installs are rounded directory displays, not independently verified users or evidence of quality, safety or growth.", "url": "https://github.com/anthropics/skills", "observedOn": "2026-10-19", "value": 182031, "metric": "repository-stars", "scope": "Entire anthropics/skills repository, not this individual skill", "window": "Snapshot observed 2026-10-19", "observations": [ { "metric": "skills-sh-installs", "scope": "Individual pptx directory listing; rounded display", "window": "Page labels this Installs without stating a time window", "observedOn": "2026-10-19", "value": 238200, "url": "https://www.skills.sh/anthropics/skills/pptx", "note": "Selection snapshot; displayed K value converted to an approximate integer. No rate, rank or measured trend is inferred." } ] }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/pptx/SKILL.md" }, { "label": "Per-skill license", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/pptx/LICENSE.txt" }, { "label": "add_slide.py inspected source", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/pptx/scripts/add_slide.py" }, { "label": "clean.py inspected source", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/pptx/scripts/clean.py" }, { "label": "__init__.py inspected source", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/pptx/scripts/office/helpers/__init__.py" }, { "label": "Dated directory interest signal", "url": "https://www.skills.sh/anthropics/skills/pptx" } ] }, { "id": "anthropic-xlsx", "name": "Excel Spreadsheets", "owner": "Anthropic", "repository": "https://github.com/anthropics/skills", "skillPath": "skills/xlsx/SKILL.md", "sourceUrl": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/xlsx/SKILL.md", "category": "Documents", "summary": "A spreadsheet workflow for formula-based workbooks, formatting and recalculation checks. It makes useful distinctions between formulas and cached values, but verification can rewrite the workbook and does not prove the calculations are correct.", "review": { "whatItIs": "A skill for creating or editing spreadsheet files with Python libraries and a LibreOffice recalculation helper. It tells an agent how to preserve formulas, document assumptions, follow an existing workbook's conventions and check error results. It is not a spreadsheet application or an independent financial validator.", "whyUse": "Use it when the output needs editable formulas rather than a pasted table of calculated numbers. Its guidance is useful for catching missing cached values, accidental formula replacement and the difference between a script that exits successfully and a workbook that has passed meaningful checks.", "useCases": [ { "title": "Build a small capacity-planning workbook", "example": "Use synthetic inputs for five roles: hours available, planned work and a reserve percentage. Request clearly marked input cells, formula-based totals, one example row and a visible assumptions note.", "expectedResult": "A draft workbook with editable inputs and traceable formulas, recalculated and checked against hand-worked examples in an authorized runtime.", "caveat": "This example was not executed. A zero-error recalculation can still use the wrong range or assumption; compare expected totals independently." }, { "title": "Update an existing reporting template", "example": "On a copy of a monthly template, identify its designated input cells, insert synthetic current-period values and compare formula cells and external links with the retained original before recalculation.", "expectedResult": "A draft workbook that follows the template's conventions with a clear account of changed cells.", "caveat": "This example was not executed. Saving cached-value-only loads can replace formulas, and external workbook links need special handling. Avoid --force unless the loss is understood and approved." } ] }, "bestFor": [ "Formula-based workbook drafts with explicit assumptions", "Careful updates to existing spreadsheet templates" ], "requirements": [ "An agent with local file and shell access in an environment permitted by the proprietary per-skill terms; the adjacent Apache-licensed skills do not extend their license to this folder.", "Python with openpyxl, pandas and markitdown as needed; LibreOffice/soffice for actual formula recalculation. Formula strings alone do not supply cached results.", "Copies of the intended workbook and source values. Macro-enabled files, external links and newer Excel functions require separate compatibility checks; no Excel account is inherently required for the local helpers." ], "permissions": [ "Read and write spreadsheets, formulas, comments, links and embedded workbook metadata. recalc.py rewrites its input file.", "Launch LibreOffice with a temporary profile and install the helper's recalculation macro in that profile. Dependency setup and optional runtime shim paths may invoke additional local tools; no confinement is supplied by the skill itself." ], "risks": [ { "title": "Runtime not run: restrictive per-skill terms", "severity": "attention", "detail": "The pinned XLSX license subjects the skill to Anthropic-service agreements and adds restrictions on outside copies, derivatives and redistribution. No XLSX helper was imported or executed here. LibreOffice was also unavailable in this evaluation environment." }, { "title": "Recalculation rewrites the workbook", "severity": "attention", "detail": "Source review confirms that recalc.py opens a fresh LibreOffice profile, installs a recalculation macro there and saves the workbook in place. Its external-link check refuses one documented loss condition unless --force is supplied; charts and conditional-format references are explicitly outside that check's completeness claim." }, { "title": "An error-free process exit is not an error-free workbook", "severity": "attention", "detail": "The script exits nonzero only when the JSON contains an error key. A result with status errors_found exits zero. Read status and total_errors explicitly, and validate the formulas against expected business results." }, { "title": "Error scanning also matches ordinary text", "severity": "attention", "detail": "The source scanner searches for error tokens inside every string cell without checking Excel's cell error type. Text that discusses an error such as #REF! can be counted as a formula error. This is a source trace, not a workbook runtime reproduction." } ], "limitations": [ "Runtime not run because of the per-skill license boundary; LibreOffice was unavailable too. Source review does not establish successful recalculation or document safety.", "No Excel/LibreOffice compatibility, macros, external-link recovery, chart preservation, numerical correctness or real business model was tested." ], "license": { "label": "Proprietary / service terms", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/xlsx/LICENSE.txt", "note": "The separate per-skill license was read at this revision. It ties use to Anthropic-service terms and adds restrictions on copying, derivatives and redistribution; this source review does not grant permission to install or reuse it." }, "evidence": { "level": "source-reviewed", "reviewedOn": "2026-10-19", "revision": "dbd4588f9e1033efb41dad4bef2f7947c8993d44", "scope": [ "Manual review of formula/cache guidance, per-skill terms, external-link checks, profile handling, error scanning and exit-code behavior. Runtime not run.", "Pinned entrypoint, per-skill license and each file named in the report source manifest" ], "notTested": [ "Runtime not run because of the per-skill license boundary; LibreOffice was unavailable too. Source review does not establish successful recalculation or document safety.", "No Excel/LibreOffice compatibility, macros, external-link recovery, chart preservation, numerical correctness or real business model was tested.", "One bounded pass at one pinned revision; no model-effectiveness baseline, repeated trials, security certification or assurance about future versions.", "No private files, credentials, authenticated accounts, paid requests or real customer workflows. Transitive dependencies and current vulnerability advisories were not audited." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "source-review", "summary": "Runtime not run because of the per-skill license boundary; LibreOffice was unavailable too. Six manual source-review expectations: five met, with an error-scanning concern retained. No workbook was recalculated.", "environment": [ "Manual review of pinned public source; no upstream code imported or executed" ], "commands": [ "Read pinned entrypoint, per-skill license and named helper control flow; record findings without executing the upstream skill." ], "results": { "passed": 5, "failed": 1, "total": 6 }, "findings": [ { "severity": "attention", "title": "Runtime not run: restrictive per-skill terms", "detail": "The pinned XLSX license subjects the skill to Anthropic-service agreements and adds restrictions on outside copies, derivatives and redistribution. No XLSX helper was imported or executed here. LibreOffice was also unavailable in this evaluation environment." }, { "severity": "attention", "title": "Recalculation rewrites the workbook", "detail": "Source review confirms that recalc.py opens a fresh LibreOffice profile, installs a recalculation macro there and saves the workbook in place. Its external-link check refuses one documented loss condition unless --force is supplied; charts and conditional-format references are explicitly outside that check's completeness claim." }, { "severity": "attention", "title": "An error-free process exit is not an error-free workbook", "detail": "The script exits nonzero only when the JSON contains an error key. A result with status errors_found exits zero. Read status and total_errors explicitly, and validate the formulas against expected business results." }, { "severity": "attention", "title": "Error scanning also matches ordinary text", "detail": "The source scanner searches for error tokens inside every string cell without checking Excel's cell error type. Text that discusses an error such as #REF! can be counted as a formula error. This is a source trace, not a workbook runtime reproduction." } ], "limitations": [ "Runtime not run because of the per-skill license boundary; LibreOffice was unavailable too. Source review does not establish successful recalculation or document safety.", "No Excel/LibreOffice compatibility, macros, external-link recovery, chart preservation, numerical correctness or real business model was tested.", "One bounded pass at one pinned revision; no model-effectiveness baseline, repeated trials, security certification or assurance about future versions.", "No private files, credentials, authenticated accounts, paid requests or real customer workflows. Transitive dependencies and current vulnerability advisories were not audited." ], "artifact": "/skill-evaluations/anthropic-xlsx.json", "runAt": "2026-10-19" }, "popularity": { "basis": "Selected from a widely followed repository and dated skills.sh directory observations. Installs are rounded directory displays, not independently verified users or evidence of quality, safety or growth.", "url": "https://github.com/anthropics/skills", "observedOn": "2026-10-19", "value": 182031, "metric": "repository-stars", "scope": "Entire anthropics/skills repository, not this individual skill", "window": "Snapshot observed 2026-10-19", "observations": [ { "metric": "skills-sh-installs", "scope": "Individual xlsx directory listing; rounded display", "window": "Page labels this Installs without stating a time window", "observedOn": "2026-10-19", "value": 184300, "url": "https://www.skills.sh/anthropics/skills/xlsx", "note": "Selection snapshot; displayed K value converted to an approximate integer. No rate, rank or measured trend is inferred." } ] }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/xlsx/SKILL.md" }, { "label": "Per-skill license", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/xlsx/LICENSE.txt" }, { "label": "recalc.py inspected source", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/xlsx/scripts/recalc.py" }, { "label": "soffice.py inspected source", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/xlsx/scripts/office/soffice.py" }, { "label": "Dated directory interest signal", "url": "https://www.skills.sh/anthropics/skills/xlsx" } ] }, { "id": "anthropic-mcp-builder", "name": "MCP Server Builder", "owner": "Anthropic", "repository": "https://github.com/anthropics/skills", "skillPath": "skills/mcp-builder/SKILL.md", "sourceUrl": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/mcp-builder/SKILL.md", "category": "Development", "summary": "A guide for building MCP servers with clear tool contracts, transport choices and evaluation questions. Its included evaluation runner needs extra care around parallel tool calls and diagnostic disclosure.", "review": { "whatItIs": "A development skill for creating a Model Context Protocol server: the adapter that lets an agent discover and call a system's tools. It covers API research, schemas, tool naming, pagination, implementation and evaluation, with Python and TypeScript references. Installing this skill does not itself give an agent a working connection to your systems.", "whyUse": "Use it when you need to expose a well-defined service through MCP and want a checklist that goes beyond merely starting a server. It makes the developer consider what a tool returns, how errors guide the caller and whether realistic questions can be answered. Authentication, authorization and safe tool behavior still have to be implemented and tested.", "useCases": [ { "title": "Expose a synthetic policy library", "example": "Ask for a local, read-only MCP server over ten synthetic policy records. Define search and read tools, bounded results, input schemas and answers for ten stable evaluation questions before connecting any real content.", "expectedResult": "A server draft and test plan whose contracts can be inspected and exercised against the fixture.", "caveat": "No complete server was generated or connected in this pass. Read-only annotations are hints; enforce read-only behavior in the implementation and underlying credentials." }, { "title": "Review an existing integration contract", "example": "Give the agent a synthetic inventory API specification and ask it to propose tool names, pagination, validation errors and a separate approval boundary for inventory changes.", "expectedResult": "A concrete MCP tool specification and coverage gaps to resolve before implementation.", "caveat": "The bundled runner handles only the first tool request in the tested two-tool response. Review or replace it before using its scores, and redact tool errors before they reach a real provider." } ] }, "bestFor": [ "Developing or reviewing MCP tool contracts", "Planning synthetic, stable evaluation questions before connecting live services" ], "requirements": [ "An agent able to read the skill and references; Node/TypeScript or Python and an appropriate MCP SDK for actual server development.", "Access to the target API specification and a deliberately scoped test service. Real integrations may require service credentials and network access.", "The supplied evaluation requirements name anthropic>=0.39.0 and mcp>=1.1.0. Its real model-based runner needs Anthropic API access; this account-free pass used sentinel imports and fake provider/transport objects." ], "permissions": [ "Read API documentation and project source; create code and execute builds, servers or inspector tools when allowed by the host.", "The full evaluation runner can launch a specified stdio command or connect to a remote MCP endpoint, call its exposed tools and send questions/results to a model provider. This review did none of those real operations." ], "risks": [ { "title": "Multiple tool requests are only partly handled", "severity": "attention", "detail": "In the fake-provider probe, a response requested two tool calls but the evaluation loop executed and answered only the first. This is a control-flow result with synthetic objects, not a live API response test; adapt and test the runner before relying on parallel tool use." }, { "title": "Diagnostic text can disclose supplied values", "severity": "attention", "detail": "A malformed credential-like header echoed its synthetic marker to stdout. A fake tool exception forwarded its marker and traceback into the next model-bound result. No real secret or provider request was used; keep sensitive values out of evaluation fixtures and sanitize logs and tool errors before connecting a real model." }, { "title": "The included model evaluation is not account-free", "severity": "attention", "detail": "The source runner constructs an Anthropic API client and sends questions and tool outputs to it. This pass replaced provider and transport interfaces with in-memory fixtures. A real evaluation needs provider access, approved data handling and explicit cost and tool-permission limits." }, { "title": "Tool annotations do not enforce permissions", "severity": "attention", "detail": "The pinned best-practices reference says annotations are hints. A server advertised as read-only still needs actual authorization, input validation and restricted underlying access." } ], "limitations": [ "Three parser/logging checks and three control-flow checks with a fake provider, fake transport and synchronous coroutine dispatch. No real model, SDK transport, server or API was exercised.", "No generated-server quality, OAuth behavior, multitenant isolation, prompt-injection resistance, concurrency, cost control or effectiveness improvement was established." ], "license": { "label": "Apache-2.0", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/mcp-builder/LICENSE.txt", "note": "The separate per-skill LICENSE.txt contains the Apache License 2.0. Dependency and third-party asset terms are separate." }, "evidence": { "level": "runtime-probed", "reviewedOn": "2026-10-19", "revision": "dbd4588f9e1033efb41dad4bef2f7947c8993d44", "scope": [ "Parser and diagnostic helpers executed unchanged; evaluation-loop control flow exercised with synthetic provider/transport objects. Documentation and connection paths inspected.", "Pinned entrypoint, per-skill license and each file named in the report source manifest" ], "notTested": [ "Three parser/logging checks and three control-flow checks with a fake provider, fake transport and synchronous coroutine dispatch. No real model, SDK transport, server or API was exercised.", "No generated-server quality, OAuth behavior, multitenant isolation, prompt-injection resistance, concurrency, cost control or effectiveness improvement was established.", "One bounded pass at one pinned revision; no model-effectiveness baseline, repeated trials, security certification or assurance about future versions.", "No private files, credentials, authenticated accounts, paid requests or real customer workflows. Transitive dependencies and current vulnerability advisories were not audited." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "helper-probe", "summary": "Six bounded checks: three met expectations and three exposed practical limits. The parser/logging functions ran locally; model and MCP interactions were fake. No API, account or generated server was tested.", "environment": [ "Python 3.12.10 on Windows 11; synthetic files only", "Application-level no-network/no-child-process guards and isolated configuration; not an OS sandbox", "Sentinel provider/transport imports, fake objects and synchronous in-memory coroutine dispatch" ], "commands": [ "python -B helper_probe.py --sources --runtime-libs " ], "results": { "passed": 3, "failed": 3, "total": 6 }, "findings": [ { "severity": "attention", "title": "Multiple tool requests are only partly handled", "detail": "In the fake-provider probe, a response requested two tool calls but the evaluation loop executed and answered only the first. This is a control-flow result with synthetic objects, not a live API response test; adapt and test the runner before relying on parallel tool use." }, { "severity": "attention", "title": "Diagnostic text can disclose supplied values", "detail": "A malformed credential-like header echoed its synthetic marker to stdout. A fake tool exception forwarded its marker and traceback into the next model-bound result. No real secret or provider request was used; keep sensitive values out of evaluation fixtures and sanitize logs and tool errors before connecting a real model." }, { "severity": "attention", "title": "The included model evaluation is not account-free", "detail": "The source runner constructs an Anthropic API client and sends questions and tool outputs to it. This pass replaced provider and transport interfaces with in-memory fixtures. A real evaluation needs provider access, approved data handling and explicit cost and tool-permission limits." } ], "limitations": [ "Three parser/logging checks and three control-flow checks with a fake provider, fake transport and synchronous coroutine dispatch. No real model, SDK transport, server or API was exercised.", "No generated-server quality, OAuth behavior, multitenant isolation, prompt-injection resistance, concurrency, cost control or effectiveness improvement was established.", "One bounded pass at one pinned revision; no model-effectiveness baseline, repeated trials, security certification or assurance about future versions.", "No private files, credentials, authenticated accounts, paid requests or real customer workflows. Transitive dependencies and current vulnerability advisories were not audited." ], "artifact": "/skill-evaluations/anthropic-mcp-builder.json", "runAt": "2026-10-19", "harness": "/skill-evaluations/expansion-helper-harness.json" }, "popularity": { "basis": "Selected from a widely followed repository and dated skills.sh directory observations. Installs are rounded directory displays, not independently verified users or evidence of quality, safety or growth.", "url": "https://github.com/anthropics/skills", "observedOn": "2026-10-19", "value": 182031, "metric": "repository-stars", "scope": "Entire anthropics/skills repository, not this individual skill", "window": "Snapshot observed 2026-10-19", "observations": [ { "metric": "skills-sh-installs", "scope": "Individual mcp-builder directory listing; rounded display", "window": "Page labels this Installs without stating a time window", "observedOn": "2026-10-19", "value": 128100, "url": "https://www.skills.sh/anthropics/skills/mcp-builder", "note": "Selection snapshot; displayed K value converted to an approximate integer. No rate, rank or measured trend is inferred." } ] }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/mcp-builder/SKILL.md" }, { "label": "Per-skill license", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/mcp-builder/LICENSE.txt" }, { "label": "evaluation.py inspected source", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/mcp-builder/scripts/evaluation.py" }, { "label": "connections.py inspected source", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/mcp-builder/scripts/connections.py" }, { "label": "requirements.txt inspected source", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/mcp-builder/scripts/requirements.txt" }, { "label": "mcp_best_practices.md inspected source", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/mcp-builder/reference/mcp_best_practices.md" }, { "label": "Dated directory interest signal", "url": "https://www.skills.sh/anthropics/skills/mcp-builder" } ] }, { "id": "anthropic-slack-gif-creator", "name": "Slack GIF Creator", "owner": "Anthropic", "repository": "https://github.com/anthropics/skills", "skillPath": "skills/slack-gif-creator/SKILL.md", "sourceUrl": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/slack-gif-creator/SKILL.md", "category": "Design", "summary": "A Python animation toolkit with drawing helpers, frame assembly and a lightweight validator. Useful for small custom animations; the validator's ready result covers dimensions rather than complete upload readiness.", "review": { "whatItIs": "A skill for drawing animation frames and assembling them into GIF files intended for Slack messages or custom emoji. It supplies motion ideas, easing functions, a frame composer, a GIF builder and validation helpers. It does not upload files or provide a library of finished graphics.", "whyUse": "Use it for a small, controlled animation that needs specific shapes, colors or timing rather than a stock reaction image. Code-based frame creation makes it possible to adjust those details explicitly. The output still needs a visual check, format and size checks, and an actual destination test when an authorized workspace is available.", "useCases": [ { "title": "Make a simple completion animation", "example": "Ask for a 128-by-128 animation that moves a check mark into place over twelve frames, using two approved brand colors and a transparent or deliberately chosen background.", "expectedResult": "A local draft GIF and a short report of its actual frame count, dimensions, file bytes and playback duration.", "caveat": "The full GIF builder was not executed here; transparency and visual quality were not evaluated. The ready helper is not sufficient evidence of GIF format, duration or destination acceptance." }, { "title": "Show a small process transition", "example": "Create a 480-by-480 message animation with three labeled stages and a moving marker. Keep the labels readable, use uniform frame timing and inspect the complete loop before sharing.", "expectedResult": "A locally generated animation draft that can be reviewed without a Slack account.", "caveat": "Only frame drawing and validation helpers were tested. Uneven frame durations were misreported, and a long or oversized file can still receive a true ready result. No upload was attempted." } ] }, "bestFor": [ "Small custom reactions and process illustrations drawn from known shapes", "Local animation drafts before an authorized upload or brand review" ], "requirements": [ "Python plus Pillow and numpy for the exercised frame and validator helpers; imageio for GIFBuilder.save. The requirements file also lists imageio-ffmpeg.", "An agent with local file/code execution access and an output folder. No Slack account is needed to create or inspect local files; uploading requires a workspace and appropriate permission.", "Synthetic or authorized source images and a visual reviewer. This pass used existing Pillow 12.3.0 and numpy 2.3.5; imageio was unavailable and no global dependency was installed." ], "permissions": [ "Read any supplied images and write local frame/GIF outputs through Python image libraries.", "A host agent can run generated drawing code and install dependencies if authorized. The skill itself has no Slack posting connector or account access; no upload occurred in this evaluation." ], "risks": [ { "title": "The ready result checks dimensions, not full readiness", "severity": "attention", "detail": "The validator accepted a PNG, a four-second emoji GIF and a 6,291,967-byte padded GIF. The latter exceeds its five-MiB warning threshold, which does not affect the boolean. These are failed IonBin readiness expectations, not claims that the helper promises strict enforcement or that Slack accepted the files. Check format, bytes and duration separately." }, { "title": "Uneven frame timing is reported incorrectly", "severity": "attention", "detail": "A GIF with 100 ms and 900 ms frames lasts 1.0 second; the helper reported 1.8 seconds by using the final frame duration for both frames. Read each frame's timing when exact playback length matters." }, { "title": "The full builder was not exercised", "severity": "attention", "detail": "The existing runtime lacked imageio, so GIFBuilder.save, palette optimization and frame deduplication were not executed. The frame composer and validator ran on synthetic files created with Pillow. No Slack upload, workspace policy or display test was performed." }, { "title": "Untrusted images still reach image decoders", "severity": "attention", "detail": "Uploaded images are opened with Pillow. The checks here used tiny synthetic images and one padded file, not malicious codecs or decompression bombs. Keep dependencies current and cap input dimensions, frame counts and bytes in your own workflow." } ], "limitations": [ "Eight local frame/validator expectations, with four failures retained. No GIFBuilder.save execution, Slack account, upload or actual destination compatibility check.", "No animation-quality benchmark, transparency check, motion-accessibility review, hostile-code containment or exhaustive image-decoder security audit." ], "license": { "label": "Apache-2.0", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/slack-gif-creator/LICENSE.txt", "note": "The separate per-skill LICENSE.txt contains the Apache License 2.0. Dependency and third-party asset terms are separate." }, "evidence": { "level": "runtime-probed", "reviewedOn": "2026-10-19", "revision": "dbd4588f9e1033efb41dad4bef2f7947c8993d44", "scope": [ "Actual frame drawing and GIF validation against synthetic Pillow files; source inspection of the unexecuted GIF builder and dependencies.", "Pinned entrypoint, per-skill license and each file named in the report source manifest" ], "notTested": [ "Eight local frame/validator expectations, with four failures retained. No GIFBuilder.save execution, Slack account, upload or actual destination compatibility check.", "No animation-quality benchmark, transparency check, motion-accessibility review, hostile-code containment or exhaustive image-decoder security audit.", "One bounded pass at one pinned revision; no model-effectiveness baseline, repeated trials, security certification or assurance about future versions.", "No private files, credentials, authenticated accounts, paid requests or real customer workflows. Transitive dependencies and current vulnerability advisories were not audited." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "helper-probe", "summary": "Eight local frame/validator checks: four met expectations and four exposed readiness or timing limits. The full GIF builder and Slack upload path were not run; all inputs were synthetic.", "environment": [ "Python 3.12.10 on Windows 11; synthetic files only", "Application-level no-network/no-child-process guards and isolated configuration; not an OS sandbox", "Existing Pillow 12.3.0 and numpy 2.3.5" ], "commands": [ "python -B helper_probe.py --sources --runtime-libs " ], "results": { "passed": 4, "failed": 4, "total": 8 }, "findings": [ { "severity": "attention", "title": "The ready result checks dimensions, not full readiness", "detail": "The validator accepted a PNG, a four-second emoji GIF and a 6,291,967-byte padded GIF. The latter exceeds its five-MiB warning threshold, which does not affect the boolean. These are failed IonBin readiness expectations, not claims that the helper promises strict enforcement or that Slack accepted the files. Check format, bytes and duration separately." }, { "severity": "attention", "title": "Uneven frame timing is reported incorrectly", "detail": "A GIF with 100 ms and 900 ms frames lasts 1.0 second; the helper reported 1.8 seconds by using the final frame duration for both frames. Read each frame's timing when exact playback length matters." }, { "severity": "attention", "title": "The full builder was not exercised", "detail": "The existing runtime lacked imageio, so GIFBuilder.save, palette optimization and frame deduplication were not executed. The frame composer and validator ran on synthetic files created with Pillow. No Slack upload, workspace policy or display test was performed." } ], "limitations": [ "Eight local frame/validator expectations, with four failures retained. No GIFBuilder.save execution, Slack account, upload or actual destination compatibility check.", "No animation-quality benchmark, transparency check, motion-accessibility review, hostile-code containment or exhaustive image-decoder security audit.", "One bounded pass at one pinned revision; no model-effectiveness baseline, repeated trials, security certification or assurance about future versions.", "No private files, credentials, authenticated accounts, paid requests or real customer workflows. Transitive dependencies and current vulnerability advisories were not audited." ], "artifact": "/skill-evaluations/anthropic-slack-gif-creator.json", "runAt": "2026-10-19", "harness": "/skill-evaluations/expansion-helper-harness.json" }, "popularity": { "basis": "Selected from a widely followed repository and dated skills.sh directory observations. Installs are rounded directory displays, not independently verified users or evidence of quality, safety or growth.", "url": "https://github.com/anthropics/skills", "observedOn": "2026-10-19", "value": 182031, "metric": "repository-stars", "scope": "Entire anthropics/skills repository, not this individual skill", "window": "Snapshot observed 2026-10-19", "observations": [ { "metric": "skills-sh-installs", "scope": "Individual slack-gif-creator directory listing; rounded display", "window": "Page labels this Installs without stating a time window", "observedOn": "2026-10-19", "value": 73800, "url": "https://www.skills.sh/anthropics/skills/slack-gif-creator", "note": "Selection snapshot; displayed K value converted to an approximate integer. No rate, rank or measured trend is inferred." } ] }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/slack-gif-creator/SKILL.md" }, { "label": "Per-skill license", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/slack-gif-creator/LICENSE.txt" }, { "label": "frame_composer.py inspected source", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/slack-gif-creator/core/frame_composer.py" }, { "label": "validators.py inspected source", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/slack-gif-creator/core/validators.py" }, { "label": "gif_builder.py inspected source", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/slack-gif-creator/core/gif_builder.py" }, { "label": "requirements.txt inspected source", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/slack-gif-creator/requirements.txt" }, { "label": "Dated directory interest signal", "url": "https://www.skills.sh/anthropics/skills/slack-gif-creator" } ] }, { "id": "mattpocock-grilling", "name": "Grilling", "owner": "Matt Pocock", "repository": "https://github.com/mattpocock/skills", "skillPath": "skills/productivity/grilling/SKILL.md", "sourceUrl": "https://github.com/mattpocock/skills/blob/49dd158d1076134a641b33efb035946536778336/skills/productivity/grilling/SKILL.md", "category": "Planning", "summary": "A decision interview that groups questions by dependency and makes unresolved assumptions visible before work starts.", "review": { "whatItIs": "Grilling gives an agent a structure for stress-testing a plan. It maps decisions and asks the questions that can be answered with what is already known. It is useful when a vague request hides choices about users, permissions, scope or delivery.", "whyUse": "Use it when the cost of building the wrong thing is higher than the cost of a focused interview. Its value is a clearer set of decisions and open questions; it does not prove that the eventual plan is correct.", "useCases": [ { "title": "Define a customer export", "example": "Grill this plan: add a CSV export for account administrators. Start with who can export which records, then ask about format and delivery. Use only the synthetic requirements I provide.", "expectedResult": "A decision tree that settles record access before fields, delivery and retention.", "caveat": "A recommendation is still a proposal. Review access and retention decisions before implementation." }, { "title": "Choose an evaluation workflow", "example": "Stress-test a process for reviewing 200 synthetic support answers. Separate decisions about the rubric, reviewer assignment and disagreement handling.", "expectedResult": "A sequence of dependent decisions, with factual gaps assigned to bounded research.", "caveat": "Do not let research cross into private customer material without an explicit data scope." } ] }, "bestFor": [ "Scoping a feature with unresolved permission or delivery decisions", "Testing a plan before turning it into implementation tasks" ], "requirements": [ "An agent that can load the instruction file and retain the interview context.", "A user available to settle consequential decisions. Subagent and filesystem/search tools are needed only for delegated fact finding.", "No skill-specific account, API key, language runtime or installation helper is specified." ], "permissions": [ "Conversation access; optional project reads or public research through the host agent.", "Delegated work inherits the host tools and permissions; the source gives no separate sandbox." ], "risks": [ { "title": "Fact finding can widen tool access", "severity": "attention", "detail": "The instructions delegate missing facts to a subagent. Limit that subagent to the relevant project and permitted sources; the skill does not enforce access controls." }, { "title": "Recommendations can steer decisions", "severity": "attention", "detail": "Every question includes a recommended answer, and yes accepts it. Ask the agent to separate evidence from assumptions and keep unresolved choices visible." } ], "limitations": [ "Instruction-only entrypoint: no executable helper was identified in the reviewed skill. No interview, model comparison, subagent research, file search or implementation workflow was run.", "The review covers this entrypoint and repository license. Host permissions, context retention, question quality and decision completeness were not evaluated." ], "license": { "label": "MIT", "url": "https://github.com/mattpocock/skills/blob/49dd158d1076134a641b33efb035946536778336/LICENSE", "note": "Repository MIT license text inspected at this revision. Preserve its copyright and permission notice when redistributing covered source; separate dependencies and services can have their own terms." }, "evidence": { "level": "source-reviewed", "reviewedOn": "2026-10-19", "revision": "49dd158d1076134a641b33efb035946536778336", "scope": [ "skills/productivity/grilling/SKILL.md", "LICENSE" ], "notTested": [ "Instruction-only entrypoint: no executable helper was identified in the reviewed skill. No interview, model comparison, subagent research, file search or implementation workflow was run.", "The review covers this entrypoint and repository license. Host permissions, context retention, question quality and decision completeness were not evaluated." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "source-review", "summary": "Completed 5 bounded source checks covering requirements, workflow boundaries and practical security concerns. No skill workflow was executed.", "environment": [ "Pinned public UTF-8 sources; exact Git blob contents fetched through GitHub and recorded with SHA-256.", "Windows 11; Python 3.12.10 source-condition verification. No account, private document or live business data." ], "commands": [ "Read each pinned file listed in sourceManifest.", "python build-guide-reviews.py — verify the recorded source conditions and reconcile report counts." ], "results": { "passed": 5, "failed": 0, "total": 5 }, "findings": [ { "severity": "attention", "title": "Fact finding can widen tool access", "detail": "The instructions delegate missing facts to a subagent. Limit that subagent to the relevant project and permitted sources; the skill does not enforce access controls." }, { "severity": "attention", "title": "Recommendations can steer decisions", "detail": "Every question includes a recommended answer, and yes accepts it. Ask the agent to separate evidence from assumptions and keep unresolved choices visible." }, { "severity": "info", "title": "Canonical skill, separate from grill-me", "detail": "The reviewed entrypoint is grilling. A different directory alias is not evidence of this skill being used, and its installation count is not transferred here." } ], "limitations": [ "Instruction-only entrypoint: no executable helper was identified in the reviewed skill. No interview, model comparison, subagent research, file search or implementation workflow was run.", "The review covers this entrypoint and repository license. Host permissions, context retention, question quality and decision completeness were not evaluated." ], "artifact": "/skill-evaluations/mattpocock-grilling.json", "runAt": "2026-10-19" }, "popularity": { "basis": "skills.sh displayed 941.2K installs for this named skill on the observation date. Rounded directory telemetry; not verified unique users, a quality score or measured growth.", "url": "https://www.skills.sh/", "observedOn": "2026-10-19", "value": 941200, "metric": "skills-sh-installs", "scope": "Directory listing for mattpocock-grilling; not the whole repository", "window": "Individual listing says Installs; reporting window not independently established", "observations": [ { "metric": "skills-sh-installs", "scope": "Canonical grilling listing in the directory Trending board", "window": "Visible tab: Trending (24h); page title: This Week", "observedOn": "2026-10-19", "value": 5700, "rank": 52, "url": "https://www.skills.sh/trending", "note": "Rounded 5.7K displayed at board position 52. The title and tab give different windows; this single snapshot is not independently verified growth or unique-user adoption." } ] }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/mattpocock/skills/blob/49dd158d1076134a641b33efb035946536778336/skills/productivity/grilling/SKILL.md" }, { "label": "Pinned repository license", "url": "https://github.com/mattpocock/skills/blob/49dd158d1076134a641b33efb035946536778336/LICENSE" }, { "label": "Dated directory popularity context", "url": "https://www.skills.sh/" }, { "label": "Dated directory trending snapshot; window ambiguity disclosed", "url": "https://www.skills.sh/trending" } ] }, { "id": "mattpocock-handoff", "name": "Handoff", "owner": "Matt Pocock", "repository": "https://github.com/mattpocock/skills", "skillPath": "skills/productivity/handoff/SKILL.md", "sourceUrl": "https://github.com/mattpocock/skills/blob/49dd158d1076134a641b33efb035946536778336/skills/productivity/handoff/SKILL.md", "category": "Agent workflows", "summary": "A compact continuation note that points to existing artifacts, records the next focus and asks the agent to redact sensitive content.", "review": { "whatItIs": "Handoff turns the current conversation into a continuation note for a fresh agent. It favors links to plans, issues and diffs over copying their contents, and it lists skills the next agent may need.", "whyUse": "Use it when a task will continue in a new session and the next agent needs the current decision state. It can reduce repeated orientation, but the note still needs an owner, a reachable location and a review for omissions or secrets.", "useCases": [ { "title": "Continue a synthetic code review", "example": "Create a handoff for the next session to review the CSV export. Reference docs/export-plan.md and the current diff; list remaining access checks and replace credentials with placeholders.", "expectedResult": "A short continuation note with the next review objective and references to the source artifacts.", "caveat": "The default temporary location is not durable, and referenced paths must exist for the receiving agent." }, { "title": "Transfer a content QA task", "example": "Prepare a handoff focused on checking the next ten public review pages. Record the agreed rubric, pages already checked and unresolved findings without duplicating the rubric file.", "expectedResult": "A focused next-step note that distinguishes completed checks from open work.", "caveat": "A model summary can omit failures or turn assumptions into decisions. Reconcile it with the actual work list." } ] }, "bestFor": [ "Continuing a multi-session task", "Passing a bounded review to a fresh agent" ], "requirements": [ "A host that exposes the current conversation and can write a text file.", "Access to the existing artifacts the handoff references; receiving agent access is a separate requirement.", "No external service or account is required by the entrypoint." ], "permissions": [ "Read the conversation and relevant artifacts; write to the OS temporary directory.", "Suggested future skills may bring their own permissions. The handoff does not authorize those tools." ], "risks": [ { "title": "Redaction is an instruction, not a control", "severity": "high", "detail": "The guide tells the model to remove secrets and personal information but has no scanner or validator. Review a handoff before moving it to another agent or storage system." }, { "title": "Temporary paths do not make a durable handoff", "severity": "attention", "detail": "The requested OS temporary location can be cleaned up or unavailable to another machine. Copy an approved handoff into the intended durable project location before relying on it." }, { "title": "References and suggested skills need rechecking", "severity": "attention", "detail": "A receiving agent may lack referenced files or may load a different skill version. Verify access and inspect suggested skills before following them." } ], "limitations": [ "Instruction-only entrypoint: no handoff was written from real conversation data and no fresh-agent continuation or redaction test was run.", "Temporary-folder persistence, file permissions, path portability and host support for invocation metadata were not tested." ], "license": { "label": "MIT", "url": "https://github.com/mattpocock/skills/blob/49dd158d1076134a641b33efb035946536778336/LICENSE", "note": "Repository MIT license text inspected at this revision. Preserve its copyright and permission notice when redistributing covered source; separate dependencies and services can have their own terms." }, "evidence": { "level": "source-reviewed", "reviewedOn": "2026-10-19", "revision": "49dd158d1076134a641b33efb035946536778336", "scope": [ "skills/productivity/handoff/SKILL.md", "LICENSE" ], "notTested": [ "Instruction-only entrypoint: no handoff was written from real conversation data and no fresh-agent continuation or redaction test was run.", "Temporary-folder persistence, file permissions, path portability and host support for invocation metadata were not tested." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "source-review", "summary": "Completed 5 bounded source checks covering requirements, workflow boundaries and practical security concerns. No skill workflow was executed.", "environment": [ "Pinned public UTF-8 sources; exact Git blob contents fetched through GitHub and recorded with SHA-256.", "Windows 11; Python 3.12.10 source-condition verification. No account, private document or live business data." ], "commands": [ "Read each pinned file listed in sourceManifest.", "python build-guide-reviews.py — verify the recorded source conditions and reconcile report counts." ], "results": { "passed": 5, "failed": 0, "total": 5 }, "findings": [ { "severity": "high", "title": "Redaction is an instruction, not a control", "detail": "The guide tells the model to remove secrets and personal information but has no scanner or validator. Review a handoff before moving it to another agent or storage system." }, { "severity": "attention", "title": "Temporary paths do not make a durable handoff", "detail": "The requested OS temporary location can be cleaned up or unavailable to another machine. Copy an approved handoff into the intended durable project location before relying on it." }, { "severity": "attention", "title": "References and suggested skills need rechecking", "detail": "A receiving agent may lack referenced files or may load a different skill version. Verify access and inspect suggested skills before following them." } ], "limitations": [ "Instruction-only entrypoint: no handoff was written from real conversation data and no fresh-agent continuation or redaction test was run.", "Temporary-folder persistence, file permissions, path portability and host support for invocation metadata were not tested." ], "artifact": "/skill-evaluations/mattpocock-handoff.json", "runAt": "2026-10-19" }, "popularity": { "basis": "skills.sh displayed 1.0M installs for this named skill on the observation date. Rounded directory telemetry; not verified unique users, a quality score or measured growth.", "url": "https://www.skills.sh/mattpocock/skills/handoff", "observedOn": "2026-10-19", "value": 1000000, "metric": "skills-sh-installs", "scope": "Directory listing for mattpocock-handoff; not the whole repository", "window": "Individual listing says Installs; reporting window not independently established" }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/mattpocock/skills/blob/49dd158d1076134a641b33efb035946536778336/skills/productivity/handoff/SKILL.md" }, { "label": "Pinned repository license", "url": "https://github.com/mattpocock/skills/blob/49dd158d1076134a641b33efb035946536778336/LICENSE" }, { "label": "Dated directory popularity context", "url": "https://www.skills.sh/mattpocock/skills/handoff" } ] }, { "id": "supabase-postgres-best-practices", "name": "Supabase Postgres Best Practices", "owner": "Supabase", "repository": "https://github.com/supabase/agent-skills", "skillPath": "skills/supabase-postgres-best-practices/SKILL.md", "sourceUrl": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase-postgres-best-practices/SKILL.md", "category": "Databases", "summary": "A topic-based SQL review guide covering query plans, schema design, connection management and row-level security.", "review": { "whatItIs": "This skill points an agent to Postgres rules and SQL examples selected for the task at hand. Supabase maintains it, but much of the guidance applies to Postgres outside Supabase. The reviewed version is 1.1.1.", "whyUse": "Use it as a checklist when reviewing a query or migration. It makes the agent consider identity, privileges and diagnostic evidence alongside performance. The database role, schema and workload still determine whether a proposed change is correct.", "useCases": [ { "title": "Review tenant access", "example": "Review this synthetic orders table and RLS policy. Identify the trusted user identity, role privileges and cases for two users who must not see each other's rows. Do not connect to a database.", "expectedResult": "A proposed access-test matrix and a review of the policy assumptions.", "caveat": "A SQL review is not a passing tenant-isolation test. Execute allowed and denied cases in a disposable database before adoption." }, { "title": "Diagnose an order lookup", "example": "Review a synthetic query filtering orders by customer_id and status. Explain which execution-plan evidence would justify an index and what write overhead to measure.", "expectedResult": "A narrow measurement plan and candidate index reasoning tied to the query.", "caveat": "EXPLAIN ANALYZE executes the query. A sequential scan is not automatically a defect, and an extra index has write and storage costs." } ] }, "bestFor": [ "Reviewing Postgres SQL, schema changes and RLS assumptions", "Planning query diagnostics before making performance changes" ], "requirements": [ "An agent able to read the topic files and the relevant SQL or schema.", "A separately configured disposable Postgres database is needed for runtime validation; Supabase-specific auth.uid() examples need matching identity facilities.", "No account is needed to read the guide. Live Supabase access, connection strings and privileges are separate dependencies." ], "permissions": [ "Read SQL, schema and query plans.", "Any generated SQL executes with the connected database role. DDL, role grants and diagnostics need their own authorization." ], "risks": [ { "title": "A tenant setting is not authentication", "severity": "high", "detail": "The generic policy example reads app.current_user_id. If a caller can choose or overwrite that value, the example alone does not prove tenant isolation. Test trusted identity setup and both allowed and denied rows under the actual application role." }, { "title": "Privileged helpers need caller-role tests", "severity": "high", "detail": "SECURITY DEFINER guidance crosses a privilege boundary. Verify schema exposure, search_path, EXECUTE grants and identity checks together; the sample revokes direct execution from named roles, so validate the intended policy call path before using it." }, { "title": "Diagnostics and migrations can change state", "severity": "attention", "detail": "EXPLAIN ANALYZE executes its query; schema, index and role examples also change the database. Use a disposable database or a reviewed maintenance plan before applying generated SQL." } ], "limitations": [ "Source review of the entrypoint and six selected rules; not every rule in the repository. No Postgres process, SQL query, migration, Supabase project or authenticated RLS session was executed.", "No performance gain, tenant isolation guarantee, permission correctness, connection-pool compatibility or version-wide security conclusion is established." ], "license": { "label": "MIT", "url": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/LICENSE", "note": "Repository MIT license text inspected at this revision. Preserve its copyright and permission notice when redistributing covered source; separate dependencies and services can have their own terms." }, "evidence": { "level": "source-reviewed", "reviewedOn": "2026-10-19", "revision": "c9be0e931b7930f7d02126d04774d904c381e7d7", "scope": [ "skills/supabase-postgres-best-practices/SKILL.md", "LICENSE", "skills/supabase-postgres-best-practices/references/security-rls-basics.md", "skills/supabase-postgres-best-practices/references/security-privileges.md", "skills/supabase-postgres-best-practices/references/security-rls-performance.md", "skills/supabase-postgres-best-practices/references/monitor-explain-analyze.md", "skills/supabase-postgres-best-practices/references/query-missing-indexes.md", "skills/supabase-postgres-best-practices/references/conn-pooling.md" ], "notTested": [ "Source review of the entrypoint and six selected rules; not every rule in the repository. No Postgres process, SQL query, migration, Supabase project or authenticated RLS session was executed.", "No performance gain, tenant isolation guarantee, permission correctness, connection-pool compatibility or version-wide security conclusion is established." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "source-review", "summary": "Completed 6 bounded source checks covering requirements, workflow boundaries and practical security concerns. No skill workflow was executed.", "environment": [ "Pinned public UTF-8 sources; exact Git blob contents fetched through GitHub and recorded with SHA-256.", "Windows 11; Python 3.12.10 source-condition verification. No account, private document or live business data." ], "commands": [ "Read each pinned file listed in sourceManifest.", "python build-guide-reviews.py — verify the recorded source conditions and reconcile report counts." ], "results": { "passed": 6, "failed": 0, "total": 6 }, "findings": [ { "severity": "high", "title": "A tenant setting is not authentication", "detail": "The generic policy example reads app.current_user_id. If a caller can choose or overwrite that value, the example alone does not prove tenant isolation. Test trusted identity setup and both allowed and denied rows under the actual application role." }, { "severity": "high", "title": "Privileged helpers need caller-role tests", "detail": "SECURITY DEFINER guidance crosses a privilege boundary. Verify schema exposure, search_path, EXECUTE grants and identity checks together; the sample revokes direct execution from named roles, so validate the intended policy call path before using it." }, { "severity": "attention", "title": "Diagnostics and migrations can change state", "detail": "EXPLAIN ANALYZE executes its query; schema, index and role examples also change the database. Use a disposable database or a reviewed maintenance plan before applying generated SQL." }, { "severity": "info", "title": "Performance figures were not reproduced", "detail": "The source contains example timing and speedup claims. IonBin did not execute those workloads or adopt those figures as measured results." } ], "limitations": [ "Source review of the entrypoint and six selected rules; not every rule in the repository. No Postgres process, SQL query, migration, Supabase project or authenticated RLS session was executed.", "No performance gain, tenant isolation guarantee, permission correctness, connection-pool compatibility or version-wide security conclusion is established." ], "artifact": "/skill-evaluations/supabase-postgres-best-practices.json", "runAt": "2026-10-19" }, "popularity": { "basis": "skills.sh displayed 450.4K installs for this named skill on the observation date. Rounded directory telemetry; not verified unique users, a quality score or measured growth.", "url": "https://www.skills.sh/supabase/agent-skills/supabase-postgres-best-practices", "observedOn": "2026-10-19", "value": 450400, "metric": "skills-sh-installs", "scope": "Directory listing for supabase-postgres-best-practices; not the whole repository", "window": "Individual listing says Installs; reporting window not independently established" }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase-postgres-best-practices/SKILL.md" }, { "label": "Pinned repository license", "url": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/LICENSE" }, { "label": "Reviewed security-rls-basics.md", "url": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase-postgres-best-practices/references/security-rls-basics.md" }, { "label": "Reviewed security-privileges.md", "url": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase-postgres-best-practices/references/security-privileges.md" }, { "label": "Reviewed security-rls-performance.md", "url": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase-postgres-best-practices/references/security-rls-performance.md" }, { "label": "Reviewed monitor-explain-analyze.md", "url": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase-postgres-best-practices/references/monitor-explain-analyze.md" }, { "label": "Reviewed query-missing-indexes.md", "url": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase-postgres-best-practices/references/query-missing-indexes.md" }, { "label": "Reviewed conn-pooling.md", "url": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase-postgres-best-practices/references/conn-pooling.md" }, { "label": "Dated directory popularity context", "url": "https://www.skills.sh/supabase/agent-skills/supabase-postgres-best-practices" } ] }, { "id": "marketing-cro", "name": "Conversion Rate Optimization", "owner": "Corey Haines", "repository": "https://github.com/coreyhaines31/marketingskills", "skillPath": "skills/cro/SKILL.md", "sourceUrl": "https://github.com/coreyhaines31/marketingskills/blob/365b412152b9542499ca1439426f7fc3cc92bb65/skills/cro/SKILL.md", "category": "Marketing", "summary": "A structured review of marketing pages and lead forms, with prioritized fixes, copy alternatives and experiments to validate.", "review": { "whatItIs": "CRO helps an agent examine a page from the visitor's point of view: what it offers, who it is for, what to do next and what makes that action difficult. Version 2.0.3 combines page and form guidance under cro, with separate references for forms and experiment ideas.", "whyUse": "Use it to turn vague feedback about a page into specific issues and testable changes. It is most useful with a stated conversion goal, known traffic sources and trustworthy baseline data; it cannot tell you that a rewrite increased conversions without a real measurement design.", "useCases": [ { "title": "Review a service landing page", "example": "Review this synthetic landing-page copy for visitors arriving from an ad about a data-cleanup service. The only conversion is requesting an assessment. Identify message mismatch and propose three CTA alternatives without invented customer claims.", "expectedResult": "A prioritized review tied to the visitor intent, plus copy alternatives and hypotheses to test.", "caveat": "Traffic quality, seasonality and tracking changes can move conversion rates independently of copy." }, { "title": "Reduce form friction", "example": "Review a synthetic demo form asking for name, email, phone, team size and free-text goals. Explain which fields are needed before follow-up, preserve input on validation errors and propose an experiment.", "expectedResult": "A field-by-field rationale and an experiment plan with a clear completion definition.", "caveat": "Do not remove necessary consent, qualification or accessibility requirements just to reduce field count." } ] }, "bestFor": [ "Auditing a marketing page against a specific visitor intent", "Reviewing lead/contact forms and planning measurable experiments" ], "requirements": [ "An agent with page copy or a permitted page snapshot and product/audience context.", "Product-marketing context files are optional but explicitly checked. Signup and test-design tasks route to separate skills.", "No helper runtime or account is required for source-guided review. Live analytics, session recordings and enrichment tools add separate accounts and permissions." ], "permissions": [ "Read supplied page content and relevant product-marketing files.", "Browser access, analytics reads, contact enrichment, page edits and experiment publication are separate host capabilities, not permissions granted by this document." ], "risks": [ { "title": "Recommendations are test hypotheses", "severity": "attention", "detail": "The guide suggests prioritization and experiments, and its form reference includes numerical rules of thumb. Those numbers are source assertions, not results from this review or a forecast for your site." }, { "title": "Proof and privacy claims need real support", "severity": "high", "detail": "Suggested testimonials, customer counts, security badges, guarantees and privacy assurances are not facts to invent. Use verified claims that match the actual service and data handling." }, { "title": "Measurement and enrichment add data exposure", "severity": "attention", "detail": "Field-level analytics, session recordings and lead enrichment can expose contact details or user behavior to other systems. Scope inputs, collection and vendor access before connecting tools." } ], "limitations": [ "Source review only. No landing-page audit was executed by a conditioned model, no browser form was submitted and no analytics, enrichment or A/B testing account was accessed.", "The seven upstream eval prompts were inspected as task descriptions, not run or scored. No conversion improvement, causal effect, accessibility conformance or statistical validity was measured.", "The mutable main-branch revops reference is outside this pinned review. Recheck it and any related skills before following their instructions." ], "license": { "label": "MIT", "url": "https://github.com/coreyhaines31/marketingskills/blob/365b412152b9542499ca1439426f7fc3cc92bb65/LICENSE", "note": "Repository MIT license text inspected at this revision. Preserve its copyright and permission notice when redistributing covered source; separate dependencies and services can have their own terms." }, "evidence": { "level": "source-reviewed", "reviewedOn": "2026-10-19", "revision": "365b412152b9542499ca1439426f7fc3cc92bb65", "scope": [ "skills/cro/SKILL.md", "LICENSE", "skills/cro/references/form.md", "skills/cro/references/experiments.md", "skills/cro/evals/evals.json", "VERSIONS.md" ], "notTested": [ "Source review only. No landing-page audit was executed by a conditioned model, no browser form was submitted and no analytics, enrichment or A/B testing account was accessed.", "The seven upstream eval prompts were inspected as task descriptions, not run or scored. No conversion improvement, causal effect, accessibility conformance or statistical validity was measured.", "The mutable main-branch revops reference is outside this pinned review. Recheck it and any related skills before following their instructions." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "source-review", "summary": "Completed 6 bounded source checks covering requirements, workflow boundaries and practical security concerns. No skill workflow was executed.", "environment": [ "Pinned public UTF-8 sources; exact Git blob contents fetched through GitHub and recorded with SHA-256.", "Windows 11; Python 3.12.10 source-condition verification. No account, private document or live business data." ], "commands": [ "Read each pinned file listed in sourceManifest.", "python build-guide-reviews.py — verify the recorded source conditions and reconcile report counts." ], "results": { "passed": 6, "failed": 0, "total": 6 }, "findings": [ { "severity": "attention", "title": "Recommendations are test hypotheses", "detail": "The guide suggests prioritization and experiments, and its form reference includes numerical rules of thumb. Those numbers are source assertions, not results from this review or a forecast for your site." }, { "severity": "high", "title": "Proof and privacy claims need real support", "detail": "Suggested testimonials, customer counts, security badges, guarantees and privacy assurances are not facts to invent. Use verified claims that match the actual service and data handling." }, { "severity": "attention", "title": "Measurement and enrichment add data exposure", "detail": "Field-level analytics, session recordings and lead enrichment can expose contact details or user behavior to other systems. Scope inputs, collection and vendor access before connecting tools." }, { "severity": "info", "title": "Review uses the renamed CRO entrypoint", "detail": "Current cro combines page and form guidance. Its own 85.5K displayed installs are used; the older page-cro listing is not added to that figure." } ], "limitations": [ "Source review only. No landing-page audit was executed by a conditioned model, no browser form was submitted and no analytics, enrichment or A/B testing account was accessed.", "The seven upstream eval prompts were inspected as task descriptions, not run or scored. No conversion improvement, causal effect, accessibility conformance or statistical validity was measured.", "The mutable main-branch revops reference is outside this pinned review. Recheck it and any related skills before following their instructions." ], "artifact": "/skill-evaluations/marketing-cro.json", "runAt": "2026-10-19" }, "popularity": { "basis": "skills.sh displayed 85.5K installs for this named skill on the observation date. Rounded directory telemetry; not verified unique users, a quality score or measured growth.", "url": "https://www.skills.sh/coreyhaines31/marketingskills/cro", "observedOn": "2026-10-19", "value": 85500, "metric": "skills-sh-installs", "scope": "Directory listing for marketing-cro; not the whole repository", "window": "Individual listing says Installs; reporting window not independently established" }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/coreyhaines31/marketingskills/blob/365b412152b9542499ca1439426f7fc3cc92bb65/skills/cro/SKILL.md" }, { "label": "Pinned repository license", "url": "https://github.com/coreyhaines31/marketingskills/blob/365b412152b9542499ca1439426f7fc3cc92bb65/LICENSE" }, { "label": "Reviewed form.md", "url": "https://github.com/coreyhaines31/marketingskills/blob/365b412152b9542499ca1439426f7fc3cc92bb65/skills/cro/references/form.md" }, { "label": "Reviewed experiments.md", "url": "https://github.com/coreyhaines31/marketingskills/blob/365b412152b9542499ca1439426f7fc3cc92bb65/skills/cro/references/experiments.md" }, { "label": "Reviewed evals.json", "url": "https://github.com/coreyhaines31/marketingskills/blob/365b412152b9542499ca1439426f7fc3cc92bb65/skills/cro/evals/evals.json" }, { "label": "Reviewed VERSIONS.md", "url": "https://github.com/coreyhaines31/marketingskills/blob/365b412152b9542499ca1439426f7fc3cc92bb65/VERSIONS.md" }, { "label": "Dated directory popularity context", "url": "https://www.skills.sh/coreyhaines31/marketingskills/cro" } ] }, { "id": "mattpocock-git-guardrails", "name": "Git Guardrails for Claude Code", "owner": "Matt Pocock", "repository": "https://github.com/mattpocock/skills", "skillPath": "skills/misc/git-guardrails-claude-code/SKILL.md", "sourceUrl": "https://github.com/mattpocock/skills/blob/49dd158d1076134a641b33efb035946536778336/skills/misc/git-guardrails-claude-code/SKILL.md", "category": "Developer safety", "summary": "A Bash hook setup guide that blocks selected Git command text, with important gaps in command parsing and error handling.", "review": { "whatItIs": "This skill installs a shell script as a Claude Code PreToolUse hook. The script reads JSON input and looks for a small list of Git command patterns, returning exit 2 when it finds one. It is a reminder layer around selected operations, not a general command authorization system.", "whyUse": "It may help an operator notice a plain push, hard reset or forced clean before a Bash tool call runs. Use it only with an understanding of the matcher and its failure modes, and keep repository permissions and recovery measures in place.", "useCases": [ { "title": "Check a project-only hook before adoption", "example": "In a disposable fixture, send the JSON command git push origin main to the hook and check for exit 2. Keep the represented Git command as input data; do not execute it or install global settings.", "expectedResult": "A captured exit code and blocked message for the direct pattern, if the host dependencies are available.", "caveat": "IonBin could not run this hook in the current sandbox. Verify jq and the hook protocol before adoption." }, { "title": "Probe command variants", "example": "Compare JSON inputs for git push, git -C synthetic-repo push and a harmless quoted string containing git push. Record both missed blocks and false positives.", "expectedResult": "An explicit list of what this pattern matcher does and does not intercept.", "caveat": "Even a passing small fixture suite cannot establish coverage for arbitrary shell syntax." } ] }, "bestFor": [ "Adding a narrow warning before selected Bash Git operations", "Reviewing the limits of a hook before installing it" ], "requirements": [ "Claude Code hook support and an operator-chosen project or global settings scope.", "Bash, jq, grep and cat must be available to the hook. Git Bash could not start in this evaluation sandbox.", "No account is required for testing JSON inputs; a live Git remote is not needed and was not used." ], "permissions": [ "Writes a hook file and merges .claude/settings.json when installed. Global scope affects all projects for that user.", "The hook reads proposed command text through stdin. The reviewed script does not execute that text." ], "risks": [ { "title": "Substring patterns are not a Git permission boundary", "severity": "high", "detail": "The script searches for literal phrases such as git push. By source inspection, global Git options, tabs or a quoted executable can avoid those exact phrases, while a harmless quoted description can match them. Treat this as a convenience warning, not repository protection." }, { "title": "Parser errors have no explicit deny path", "severity": "high", "detail": "The script captures jq output but does not check jq exit status, validate the command field or stop on parser failure. Its final exit 0 means a missing parser or invalid JSON can reach an allow result by source inspection; runtime confirmation is still blocked." }, { "title": "Coverage is limited to the Bash hook", "severity": "attention", "detail": "Other tool names, direct process APIs, host configuration changes and commands outside the listed patterns are not covered by the documented matcher. Keep version-control permissions and backups independent of this hook." } ], "limitations": [ "The hook did not execute: the host sandbox prevented Git Bash initialization before any test input could reach it. A scoped execution retry was not run because the automatic approval service reported a capacity error.", "Fifteen synthetic JSON cases are supplied in the reproduction harness, but none is counted as an executed hook test. No settings were changed and no represented Git command was executed.", "No installed host integration, alternate-shell coverage, exhaustive command parser analysis or security certification. Source review identifies concerns; it does not measure bypass frequency." ], "license": { "label": "MIT", "url": "https://github.com/mattpocock/skills/blob/49dd158d1076134a641b33efb035946536778336/LICENSE", "note": "Repository MIT license text inspected at this revision. Preserve its copyright and permission notice when redistributing covered source; separate dependencies and services can have their own terms." }, "evidence": { "level": "source-reviewed", "reviewedOn": "2026-10-19", "revision": "49dd158d1076134a641b33efb035946536778336", "scope": [ "skills/misc/git-guardrails-claude-code/SKILL.md", "LICENSE", "skills/misc/git-guardrails-claude-code/scripts/block-dangerous-git.sh", "skills/misc/README.md" ], "notTested": [ "The hook did not execute: the host sandbox prevented Git Bash initialization before any test input could reach it. A scoped execution retry was not run because the automatic approval service reported a capacity error.", "Fifteen synthetic JSON cases are supplied in the reproduction harness, but none is counted as an executed hook test. No settings were changed and no represented Git command was executed.", "No installed host integration, alternate-shell coverage, exhaustive command parser analysis or security certification. Source review identifies concerns; it does not measure bypass frequency." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "source-review", "summary": "Six source checks completed. Runtime attempted but blocked before Bash could initialize; zero hook cases executed. Literal-pattern and parser-failure concerns remain source findings.", "environment": [ "Pinned public UTF-8 sources; exact Git blob contents fetched through GitHub and recorded with SHA-256.", "Windows 11; Python 3.12.10 source-condition verification. No account, private document or live business data." ], "commands": [ "Read each pinned file listed in sourceManifest.", "python build-guide-reviews.py — verify the recorded source conditions and reconcile report counts." ], "results": { "passed": 6, "failed": 0, "total": 6 }, "findings": [ { "severity": "high", "title": "Substring patterns are not a Git permission boundary", "detail": "The script searches for literal phrases such as git push. By source inspection, global Git options, tabs or a quoted executable can avoid those exact phrases, while a harmless quoted description can match them. Treat this as a convenience warning, not repository protection." }, { "severity": "high", "title": "Parser errors have no explicit deny path", "detail": "The script captures jq output but does not check jq exit status, validate the command field or stop on parser failure. Its final exit 0 means a missing parser or invalid JSON can reach an allow result by source inspection; runtime confirmation is still blocked." }, { "severity": "attention", "title": "Coverage is limited to the Bash hook", "detail": "Other tool names, direct process APIs, host configuration changes and commands outside the listed patterns are not covered by the documented matcher. Keep version-control permissions and backups independent of this hook." }, { "severity": "info", "title": "Current catalog placement is miscellaneous", "detail": "The current repository keeps this entry under misc, outside the promoted plugin set. A high directory install count does not establish active upstream use or maintenance quality." } ], "limitations": [ "The hook did not execute: the host sandbox prevented Git Bash initialization before any test input could reach it. A scoped execution retry was not run because the automatic approval service reported a capacity error.", "Fifteen synthetic JSON cases are supplied in the reproduction harness, but none is counted as an executed hook test. No settings were changed and no represented Git command was executed.", "No installed host integration, alternate-shell coverage, exhaustive command parser analysis or security certification. Source review identifies concerns; it does not measure bypass frequency." ], "artifact": "/skill-evaluations/mattpocock-git-guardrails.json", "runAt": "2026-10-19", "harness": "/skill-evaluations/guide-reproduction.json" }, "popularity": { "basis": "skills.sh displayed 479.9K installs for this named skill on the observation date. Rounded directory telemetry; not verified unique users, a quality score or measured growth.", "url": "https://www.skills.sh/mattpocock/skills/git-guardrails-claude-code", "observedOn": "2026-10-19", "value": 479900, "metric": "skills-sh-installs", "scope": "Directory listing for mattpocock-git-guardrails; not the whole repository", "window": "Individual listing says Installs; reporting window not independently established" }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/mattpocock/skills/blob/49dd158d1076134a641b33efb035946536778336/skills/misc/git-guardrails-claude-code/SKILL.md" }, { "label": "Pinned repository license", "url": "https://github.com/mattpocock/skills/blob/49dd158d1076134a641b33efb035946536778336/LICENSE" }, { "label": "Reviewed block-dangerous-git.sh", "url": "https://github.com/mattpocock/skills/blob/49dd158d1076134a641b33efb035946536778336/skills/misc/git-guardrails-claude-code/scripts/block-dangerous-git.sh" }, { "label": "Reviewed README.md", "url": "https://github.com/mattpocock/skills/blob/49dd158d1076134a641b33efb035946536778336/skills/misc/README.md" }, { "label": "Dated directory popularity context", "url": "https://www.skills.sh/mattpocock/skills/git-guardrails-claude-code" } ] }, { "id": "superpowers-brainstorming", "name": "Brainstorming", "owner": "Superpowers", "repository": "https://github.com/obra/superpowers", "skillPath": "skills/brainstorming/SKILL.md", "sourceUrl": "https://github.com/obra/superpowers/blob/bb92a77741419a4ab5f06e711a283343f1ada0c3/skills/brainstorming/SKILL.md", "category": "Planning", "summary": "A requirements conversation with explicit scope choices, a design review and an optional local visual companion.", "review": { "whatItIs": "Brainstorming helps an agent work out what a person wants before building a substantial change. It distinguishes a clear small request from a project that needs a written design. Its optional visual companion serves local mockups and collects choice events.", "whyUse": "Use it when several plausible implementations could satisfy the request and the differences matter. It makes assumptions and approval points visible; the visual companion can make layout choices easier to discuss when the user accepts it.", "useCases": [ { "title": "Scope an internal review screen", "example": "Help define a screen for reviewers to compare two synthetic answers. Start with the reviewer decision and existing project constraints; distinguish my requirements from your proposed defaults.", "expectedResult": "A scoped description with explicit assumptions, followed by approval before building the agreed project.", "caveat": "The skill supports a skip-questions path. Use the amount of discussion the task needs, not a mandatory long interview." }, { "title": "Compare mockup layouts", "example": "Offer two local mockups for a review queue using synthetic rows only. Keep the companion on loopback, disable remote branding, and treat a spike as disposable until approved.", "expectedResult": "A local visual comparison and a record of the selected direction.", "caveat": "Seven exported helper checks passed; the browser experience and HTTP security behavior remain untested. Review HTML and avoid sensitive records." } ] }, "bestFor": [ "Clarifying a substantial feature or design request", "Discussing layout alternatives through an optional local preview" ], "requirements": [ "An instruction-capable agent and a user who can confirm design decisions. Subagents are optional for the builder check.", "Optional visual companion: Node.js, a browser, a local listening port and Bash for the supplied launcher scripts. The text-only path needs none of those helper services.", "No hosted account is required. The default visual branding can reference a remote image; disable it when appropriate and review mockup assets separately." ], "permissions": [ "Read relevant project material; write a design document and, in a software project, commit it when authorized.", "Optional preview server reads/writes its session content and state, binds a local port and can launch a browser when explicitly enabled. Binding beyond loopback broadens access." ], "risks": [ { "title": "Local previews still contain active web content", "severity": "attention", "detail": "The server inserts supplied HTML without sanitizing it and serves helper JavaScript. Its frame-ancestors policy is not an outbound-content sandbox. Use reviewed synthetic content, avoid secrets and do not load untrusted markup as a preview." }, { "title": "Default branding can make a remote image request", "severity": "attention", "detail": "Source inspection found a remote logo URL in rendered branding unless telemetry is disabled. The probe set SUPERPOWERS_DISABLE_TELEMETRY=1; no browser or remote asset request was made. That setting does not prevent arbitrary external assets in user-written mockups." }, { "title": "Session keys and stored mockups need care", "severity": "attention", "detail": "The optional server uses a session key in its bootstrap URL and cookie, and stores connection details and event data locally. Keep the default loopback bind, avoid sharing the key and check persistence and file access before using sensitive designs." } ], "limitations": [ "Seven exported-helper cases ran on Node 24.18.0/Windows. They cover frame parsing, launcher argument construction and reconnect timing, not an end-to-end brainstorming conversation.", "The optional server started on loopback, but the sandbox denied HTTP connections (EACCES) and hardlink setup (EPERM). A scoped integration retry was not executed because the approval service reported a capacity error. No HTTP authorization or WebSocket integration pass is claimed.", "No browser, remote asset fetch, account, design commit, visual quality assessment, host-agent orchestration or startup/stop shell script was executed. No Windows ACL, network-exposure or broad security guarantee." ], "license": { "label": "MIT", "url": "https://github.com/obra/superpowers/blob/bb92a77741419a4ab5f06e711a283343f1ada0c3/LICENSE", "note": "Repository MIT license text inspected at this revision. Preserve its copyright and permission notice when redistributing covered source; separate dependencies and services can have their own terms." }, "evidence": { "level": "runtime-probed", "reviewedOn": "2026-10-19", "revision": "bb92a77741419a4ab5f06e711a283343f1ada0c3", "scope": [ "skills/brainstorming/SKILL.md", "LICENSE", "skills/brainstorming/builder-check-prompt.md", "skills/brainstorming/visual-companion.md", "skills/brainstorming/scripts/server.cjs", "skills/brainstorming/scripts/helper.js", "skills/brainstorming/scripts/frame-template.html", "skills/brainstorming/scripts/start-server.sh", "skills/brainstorming/scripts/stop-server.sh" ], "notTested": [ "Seven exported-helper cases ran on Node 24.18.0/Windows. They cover frame parsing, launcher argument construction and reconnect timing, not an end-to-end brainstorming conversation.", "The optional server started on loopback, but the sandbox denied HTTP connections (EACCES) and hardlink setup (EPERM). A scoped integration retry was not executed because the approval service reported a capacity error. No HTTP authorization or WebSocket integration pass is claimed.", "No browser, remote asset fetch, account, design commit, visual quality assessment, host-agent orchestration or startup/stop shell script was executed. No Windows ACL, network-exposure or broad security guarantee." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "helper-probe", "summary": "Seven exported upstream helper cases passed. The optional loopback server integration was attempted but blocked by host permissions; no full brainstorming workflow or HTTP security pass is claimed.", "environment": [ "Windows 11 x64; Node 24.18.0. Inspected pinned server/client helper modules; no added packages.", "Synthetic strings and frames only; no accounts, external requests, user browser or private data." ], "commands": [ "node brainstorm-module-probe.cjs ", "Attempted: node brainstorm-probe.cjs ; host sandbox denied loopback client requests." ], "results": { "passed": 7, "failed": 0, "total": 7 }, "findings": [ { "severity": "info", "title": "Bounded protocol and launcher helpers passed", "detail": "Seven upstream exported-helper cases passed: masked-frame parsing, rejection of unmasked and oversized frames, incomplete-frame handling, literal Windows launcher arguments, headless launcher selection and capped reconnect backoff. These are helper results, not an executed design workflow." }, { "severity": "attention", "title": "Local previews still contain active web content", "detail": "The server inserts supplied HTML without sanitizing it and serves helper JavaScript. Its frame-ancestors policy is not an outbound-content sandbox. Use reviewed synthetic content, avoid secrets and do not load untrusted markup as a preview." }, { "severity": "attention", "title": "Default branding can make a remote image request", "detail": "Source inspection found a remote logo URL in rendered branding unless telemetry is disabled. The probe set SUPERPOWERS_DISABLE_TELEMETRY=1; no browser or remote asset request was made. That setting does not prevent arbitrary external assets in user-written mockups." }, { "severity": "attention", "title": "Session keys and stored mockups need care", "detail": "The optional server uses a session key in its bootstrap URL and cookie, and stores connection details and event data locally. Keep the default loopback bind, avoid sharing the key and check persistence and file access before using sensitive designs." }, { "severity": "info", "title": "Approval paths are more specific than a universal gate", "detail": "The current instructions allow clear small tasks and an explicit skip-questions path. Larger designs need approval; an accepted throwaway spike does not authorize keeping and extending it." } ], "limitations": [ "Seven exported-helper cases ran on Node 24.18.0/Windows. They cover frame parsing, launcher argument construction and reconnect timing, not an end-to-end brainstorming conversation.", "The optional server started on loopback, but the sandbox denied HTTP connections (EACCES) and hardlink setup (EPERM). A scoped integration retry was not executed because the approval service reported a capacity error. No HTTP authorization or WebSocket integration pass is claimed.", "No browser, remote asset fetch, account, design commit, visual quality assessment, host-agent orchestration or startup/stop shell script was executed. No Windows ACL, network-exposure or broad security guarantee." ], "artifact": "/skill-evaluations/superpowers-brainstorming.json", "runAt": "2026-10-19", "harness": "/skill-evaluations/guide-reproduction.json" }, "popularity": { "basis": "skills.sh displayed 397.0K installs for this named skill on the observation date. Rounded directory telemetry; not verified unique users, a quality score or measured growth.", "url": "https://www.skills.sh/obra/superpowers/brainstorming", "observedOn": "2026-10-19", "value": 397000, "metric": "skills-sh-installs", "scope": "Directory listing for superpowers-brainstorming; not the whole repository", "window": "Individual listing says Installs; reporting window not independently established" }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/obra/superpowers/blob/bb92a77741419a4ab5f06e711a283343f1ada0c3/skills/brainstorming/SKILL.md" }, { "label": "Pinned repository license", "url": "https://github.com/obra/superpowers/blob/bb92a77741419a4ab5f06e711a283343f1ada0c3/LICENSE" }, { "label": "Reviewed builder-check-prompt.md", "url": "https://github.com/obra/superpowers/blob/bb92a77741419a4ab5f06e711a283343f1ada0c3/skills/brainstorming/builder-check-prompt.md" }, { "label": "Reviewed visual-companion.md", "url": "https://github.com/obra/superpowers/blob/bb92a77741419a4ab5f06e711a283343f1ada0c3/skills/brainstorming/visual-companion.md" }, { "label": "Reviewed server.cjs", "url": "https://github.com/obra/superpowers/blob/bb92a77741419a4ab5f06e711a283343f1ada0c3/skills/brainstorming/scripts/server.cjs" }, { "label": "Reviewed helper.js", "url": "https://github.com/obra/superpowers/blob/bb92a77741419a4ab5f06e711a283343f1ada0c3/skills/brainstorming/scripts/helper.js" }, { "label": "Reviewed frame-template.html", "url": "https://github.com/obra/superpowers/blob/bb92a77741419a4ab5f06e711a283343f1ada0c3/skills/brainstorming/scripts/frame-template.html" }, { "label": "Reviewed start-server.sh", "url": "https://github.com/obra/superpowers/blob/bb92a77741419a4ab5f06e711a283343f1ada0c3/skills/brainstorming/scripts/start-server.sh" }, { "label": "Reviewed stop-server.sh", "url": "https://github.com/obra/superpowers/blob/bb92a77741419a4ab5f06e711a283343f1ada0c3/skills/brainstorming/scripts/stop-server.sh" }, { "label": "Dated directory popularity context", "url": "https://www.skills.sh/obra/superpowers/brainstorming" } ] }, { "id": "anthropic-internal-comms", "name": "Internal Comms", "owner": "Anthropic", "repository": "https://github.com/anthropics/skills", "skillPath": "skills/internal-comms/SKILL.md", "sourceUrl": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/internal-comms/SKILL.md", "category": "Writing & comms", "summary": "A small router that picks a format guide for status reports, newsletters, FAQs and other internal updates.", "review": { "whatItIs": "Internal Comms gives an agent a short list of internal message types and points it to a separate guide file for each one, such as Progress/Plans/Problems updates, company newsletters and FAQ answers. The SKILL.md itself is brief. The useful detail sits in the example guides, which IonBin did not review.", "whyUse": "Use it when you write the same kinds of internal updates often and want a consistent structure. It's most useful once you replace or edit the example guides to match how your own team writes. If a request doesn't fit any guide, the skill tells the agent to ask instead of guessing.", "useCases": [ { "title": "Draft a weekly team update", "example": "Turn these bullet notes into a Progress, Plans and Problems update for the ops team. Keep it under 200 words and flag anything that needs a decision.", "expectedResult": "A short update in three sections, with open decisions listed separately.", "caveat": "The facts come from your notes. Check names, dates and numbers before you send it." }, { "title": "Answer a repeated staff question", "example": "Write an FAQ answer about the new expense deadline using only the policy text I paste below.", "expectedResult": "A short answer that sticks to the pasted policy.", "caveat": "If the policy text is out of date, the answer will be too. Keep the policy owner in the loop." } ] }, "bestFor": [ "Recurring internal updates that should follow one structure", "Teams willing to adapt the bundled format guides" ], "requirements": [ "An agent that can load the skill folder, including its examples/ guide files.", "No account or script is needed. Source material for the update comes from you." ], "permissions": [ "Reads the bundled guide files and whatever notes or documents you provide.", "Writes draft text only; sending or posting is a separate step you control." ], "risks": [ { "title": "The format guides are examples, not your house style", "severity": "attention", "detail": "The entrypoint defers formatting and tone to bundled example guides. Review and edit those guides before relying on them, or the drafts will follow someone else's conventions." } ], "limitations": [ "Source review of SKILL.md and the per-skill license only. The four example guide files were not reviewed, and no draft was generated or judged.", "No writing-quality, tone or accuracy result is claimed." ], "license": { "label": "Apache-2.0", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/internal-comms/LICENSE.txt", "note": "Apache-2.0 license text inspected at this revision. Keep the license and any NOTICE when redistributing covered files. The services and accounts the skill uses have their own terms." }, "evidence": { "level": "source-reviewed", "reviewedOn": "2026-10-19", "revision": "dbd4588f9e1033efb41dad4bef2f7947c8993d44", "scope": [ "skills/internal-comms/SKILL.md", "skills/internal-comms/LICENSE.txt" ], "notTested": [ "Source review of SKILL.md and the per-skill license only. The four example guide files were not reviewed, and no draft was generated or judged.", "No writing-quality, tone or accuracy result is claimed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "source-review", "summary": "Completed 4 bounded source checks on the pinned entrypoint and license. No skill workflow was executed.", "environment": [ "Pinned public UTF-8 sources fetched from raw.githubusercontent.com at the recorded commit and hashed with SHA-256.", "Linux; Python 3.13.5 source-condition check. No account, credentials, private documents or live business data." ], "commands": [ "Read each pinned file listed in sourceManifest.", "python3 r6_skills.py: check each recorded source condition and reconcile report counts." ], "results": { "passed": 4, "failed": 0, "total": 4 }, "findings": [ { "severity": "attention", "title": "The format guides are examples, not your house style", "detail": "The entrypoint defers formatting and tone to bundled example guides. Review and edit those guides before relying on them, or the drafts will follow someone else's conventions." }, { "severity": "info", "title": "Asks rather than guesses on unknown formats", "detail": "The entrypoint tells the agent to ask for clarification when a request matches none of the guides." } ], "limitations": [ "Source review of SKILL.md and the per-skill license only. The four example guide files were not reviewed, and no draft was generated or judged.", "No writing-quality, tone or accuracy result is claimed." ], "artifact": "/skill-evaluations/anthropic-internal-comms.json", "runAt": "2026-10-19" }, "popularity": { "basis": "GitHub displayed 182,047 stars for the anthropics/skills repository on the observation date. Repository-wide; not individual skill usage, quality or safety.", "url": "https://github.com/anthropics/skills", "observedOn": "2026-10-19", "value": 182047, "metric": "repository-stars", "scope": "Entire anthropics/skills repository, not this individual skill", "window": "Snapshot observed 2026-10-19" }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/internal-comms/SKILL.md" }, { "label": "Pinned license", "url": "https://github.com/anthropics/skills/blob/dbd4588f9e1033efb41dad4bef2f7947c8993d44/skills/internal-comms/LICENSE.txt" }, { "label": "Repository (dated star count)", "url": "https://github.com/anthropics/skills" } ] }, { "id": "openai-notion-meeting-intelligence", "name": "Notion Meeting Intelligence", "owner": "Notion (in the OpenAI skills catalog)", "repository": "https://github.com/openai/skills", "skillPath": "skills/.curated/notion-meeting-intelligence/SKILL.md", "sourceUrl": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/notion-meeting-intelligence/SKILL.md", "category": "Meetings & notes", "summary": "Meeting prep that pulls context from Notion over MCP and drafts an agenda or pre-read page with owners and timeboxes.", "review": { "whatItIs": "This skill guides an agent through meeting preparation: confirm the goal and attendees, search and fetch related Notion pages through the Notion MCP server, pick a template (status, decision, planning, retro, one-on-one or brainstorming) and draft the agenda as a new Notion page. It's written for Codex, and its setup steps use Codex commands.", "whyUse": "Use it when meeting prep means hunting through old notes and specs. It keeps links to the pages it used and asks for owners and timeboxes per item. You still decide what's on the agenda and whether the research is right.", "useCases": [ { "title": "Prep a decision meeting", "example": "Prepare a 30-minute decision meeting on the Q3 pricing test. Search Notion for the test spec and last two status notes, use the decision template, and draft the page but do not share it.", "expectedResult": "A draft Notion page with context links, the decision needed, options, owners and timeboxes.", "caveat": "The skill can create and update Notion pages. Review the draft before anyone else sees it." }, { "title": "Prep a customer meeting", "example": "Pull our notes on this account from Notion and draft a one-page pre-read with open questions. Keep research claims cited.", "expectedResult": "A pre-read with linked sources and a list of open questions.", "caveat": "Notion search only finds pages your connection can see. Missing context isn't flagged automatically." } ] }, "bestFor": [ "Meeting prep from existing Notion notes and specs", "Agendas that need owners, timeboxes and links to sources" ], "requirements": [ "Codex with the Notion MCP server connected over OAuth (the skill gives Codex-specific setup commands).", "A Notion workspace with the relevant pages shared with the connection." ], "permissions": [ "Searches and reads Notion pages the connected account can access.", "Creates and updates Notion pages, and may create or link tasks in a Notion database." ], "risks": [ { "title": "It writes to Notion", "severity": "attention", "detail": "The workflow creates pages and can update them and add tasks. Use a draft area and check the result before sharing it with attendees." }, { "title": "Research claims need checking", "severity": "attention", "detail": "The skill asks the agent to add outside research with source links. Check any figures or benchmarks before they go into a pre-read." } ], "limitations": [ "Source review of SKILL.md and the per-skill license only. Reference templates, examples and the bundled evaluation files were not reviewed.", "No Notion workspace was connected and no page was created. No meeting-quality result is claimed." ], "license": { "label": "MIT (Notion Labs)", "url": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/notion-meeting-intelligence/LICENSE.txt", "note": "The per-skill MIT license names Notion Labs, Inc. as copyright holder; it was read at this revision. Keep that notice when redistributing. Notion and Codex accounts have their own terms." }, "evidence": { "level": "source-reviewed", "reviewedOn": "2026-10-19", "revision": "49f948faa9258a0c61caceaf225e179651397431", "scope": [ "skills/.curated/notion-meeting-intelligence/SKILL.md", "skills/.curated/notion-meeting-intelligence/LICENSE.txt" ], "notTested": [ "Source review of SKILL.md and the per-skill license only. Reference templates, examples and the bundled evaluation files were not reviewed.", "No Notion workspace was connected and no page was created. No meeting-quality result is claimed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "source-review", "summary": "Completed 4 bounded source checks on the pinned entrypoint and license. No skill workflow was executed.", "environment": [ "Pinned public UTF-8 sources fetched from raw.githubusercontent.com at the recorded commit and hashed with SHA-256.", "Linux; Python 3.13.5 source-condition check. No account, credentials, private documents or live business data." ], "commands": [ "Read each pinned file listed in sourceManifest.", "python3 r6_skills.py: check each recorded source condition and reconcile report counts." ], "results": { "passed": 4, "failed": 0, "total": 4 }, "findings": [ { "severity": "attention", "title": "It writes to Notion", "detail": "The workflow creates pages and can update them and add tasks. Use a draft area and check the result before sharing it with attendees." }, { "severity": "attention", "title": "Research claims need checking", "detail": "The skill asks the agent to add outside research with source links. Check any figures or benchmarks before they go into a pre-read." }, { "severity": "info", "title": "Built for Codex", "detail": "Setup steps use codex mcp commands and a Codex config flag. Other agents need their own Notion MCP setup." } ], "limitations": [ "Source review of SKILL.md and the per-skill license only. Reference templates, examples and the bundled evaluation files were not reviewed.", "No Notion workspace was connected and no page was created. No meeting-quality result is claimed." ], "artifact": "/skill-evaluations/openai-notion-meeting-intelligence.json", "runAt": "2026-10-19" }, "popularity": { "basis": "GitHub displayed 28,155 stars for the openai/skills repository on the observation date. Repository-wide; not individual skill usage, quality or safety.", "url": "https://github.com/openai/skills", "observedOn": "2026-10-19", "value": 28155, "metric": "repository-stars", "scope": "Entire openai/skills repository, not this individual skill", "window": "Snapshot observed 2026-10-19" }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/notion-meeting-intelligence/SKILL.md" }, { "label": "Pinned license", "url": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/notion-meeting-intelligence/LICENSE.txt" }, { "label": "Repository (dated star count)", "url": "https://github.com/openai/skills" } ] }, { "id": "openai-linear", "name": "Linear", "owner": "OpenAI", "repository": "https://github.com/openai/skills", "skillPath": "skills/.curated/linear/SKILL.md", "sourceUrl": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/linear/SKILL.md", "category": "Project management", "summary": "A step-by-step routine for working in Linear through its MCP server: read first, then create or update, then summarize.", "review": { "whatItIs": "The Linear skill tells an agent how to use Linear's MCP server for issues, projects, cycles, comments and documents. It sets a fixed order: clarify the goal, read the relevant issues, make changes in batches, then report what changed and what's left. It lists the MCP tools by area and gives example routines such as bug triage and sprint planning.", "whyUse": "Use it when an agent manages Linear for you and you want reads before writes and an explanation before bulk changes. Pair it with a read-only connection while you review, and switch to write access only for changes you approve.", "useCases": [ { "title": "Triage new bugs", "example": "List this week's unlabeled bugs in the Platform team, suggest a priority and label for each, and wait for my approval before changing anything.", "expectedResult": "A table of suggested priorities and labels, followed by updates only after approval.", "caveat": "The skill's own routines include applying changes. Ask for approval explicitly, or use Linear's read-only endpoint." }, { "title": "Write a cycle summary", "example": "Summarize the last completed cycle: what shipped, what moved to the next cycle and any blocked issues.", "expectedResult": "A short report built from Linear data, with issue links.", "caveat": "Summaries are only as current as the issues. Stale statuses lead to a stale report." } ] }, "bestFor": [ "Issue triage and status reports in Linear", "Agents that should read before they write" ], "requirements": [ "A Linear workspace and the Linear MCP server connected over OAuth. The setup steps are Codex-specific.", "Access to the teams and projects involved." ], "permissions": [ "Reads issues, projects, cycles, comments and documents the account can see.", "Creates and updates issues, projects, labels and comments when asked." ], "risks": [ { "title": "Bulk changes can touch many issues", "severity": "attention", "detail": "Routines such as smart labeling and workload balancing can change many issues at once. The skill says to explain grouping first; still approve each batch." } ], "limitations": [ "Source review of SKILL.md and the per-skill license only. No Linear workspace was connected and no issue was read or changed.", "No triage-quality or planning result is claimed." ], "license": { "label": "Apache-2.0", "url": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/linear/LICENSE.txt", "note": "Apache-2.0 license text inspected at this revision. Keep the license and any NOTICE when redistributing covered files. The services and accounts the skill uses have their own terms." }, "evidence": { "level": "source-reviewed", "reviewedOn": "2026-10-19", "revision": "49f948faa9258a0c61caceaf225e179651397431", "scope": [ "skills/.curated/linear/SKILL.md", "skills/.curated/linear/LICENSE.txt" ], "notTested": [ "Source review of SKILL.md and the per-skill license only. No Linear workspace was connected and no issue was read or changed.", "No triage-quality or planning result is claimed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "source-review", "summary": "Completed 4 bounded source checks on the pinned entrypoint and license. No skill workflow was executed.", "environment": [ "Pinned public UTF-8 sources fetched from raw.githubusercontent.com at the recorded commit and hashed with SHA-256.", "Linux; Python 3.13.5 source-condition check. No account, credentials, private documents or live business data." ], "commands": [ "Read each pinned file listed in sourceManifest.", "python3 r6_skills.py: check each recorded source condition and reconcile report counts." ], "results": { "passed": 4, "failed": 0, "total": 4 }, "findings": [ { "severity": "attention", "title": "Bulk changes can touch many issues", "detail": "Routines such as smart labeling and workload balancing can change many issues at once. The skill says to explain grouping first; still approve each batch." }, { "severity": "info", "title": "Read-first order", "detail": "The workflow reads to build context before creating or updating anything." } ], "limitations": [ "Source review of SKILL.md and the per-skill license only. No Linear workspace was connected and no issue was read or changed.", "No triage-quality or planning result is claimed." ], "artifact": "/skill-evaluations/openai-linear.json", "runAt": "2026-10-19" }, "popularity": { "basis": "GitHub displayed 28,155 stars for the openai/skills repository on the observation date. Repository-wide; not individual skill usage, quality or safety.", "url": "https://github.com/openai/skills", "observedOn": "2026-10-19", "value": 28155, "metric": "repository-stars", "scope": "Entire openai/skills repository, not this individual skill", "window": "Snapshot observed 2026-10-19" }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/linear/SKILL.md" }, { "label": "Pinned license", "url": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/linear/LICENSE.txt" }, { "label": "Repository (dated star count)", "url": "https://github.com/openai/skills" } ] }, { "id": "openai-transcribe", "name": "Transcribe", "owner": "OpenAI", "repository": "https://github.com/openai/skills", "skillPath": "skills/.curated/transcribe/SKILL.md", "sourceUrl": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/transcribe/SKILL.md", "category": "Meetings & notes", "summary": "Transcribes audio through OpenAI's API with a bundled Python script, with optional speaker labels.", "review": { "whatItIs": "Transcribe runs a bundled command-line script that sends audio files to OpenAI transcription models. A faster model is the default for plain text. A diarization model adds speaker labels, and you can give up to four reference clips for known speakers. It needs an OpenAI API key set locally.", "whyUse": "Use it when you need a transcript of a recording and are comfortable sending the audio to OpenAI. It tells the agent never to ask for the API key in chat and to check the output before finishing.", "useCases": [ { "title": "Transcribe an interview", "example": "Transcribe interview.mp3 to plain text and save it next to the file. Flag any sections that are hard to hear.", "expectedResult": "A text transcript and a short note on unclear passages.", "caveat": "Audio is sent to OpenAI, and API usage is billed to your key. Check consent before recording or uploading other people." }, { "title": "Label speakers in a meeting", "example": "Transcribe meeting.m4a with speaker labels, using the two reference clips I provide for Ana and Ben.", "expectedResult": "A diarized JSON transcript with speaker segments.", "caveat": "Speaker labels can be wrong. Check quotes against the audio before you attribute them." } ] }, "bestFor": [ "Transcripts of interviews and meetings", "Speaker-labelled transcripts when you have reference clips" ], "requirements": [ "Python with the openai package, and an OPENAI_API_KEY in the environment.", "Audio files on the machine the agent can reach." ], "permissions": [ "Reads local audio files and writes transcript files.", "Sends audio to the OpenAI API using your key." ], "risks": [ { "title": "Recordings leave your machine", "severity": "attention", "detail": "The script uploads audio to OpenAI. Confirm that everyone recorded agreed to it and that the content may be processed by a third party." } ], "limitations": [ "Source review of SKILL.md and the per-skill license only. The bundled script and API reference file were not reviewed or run.", "No audio was transcribed. No accuracy or diarization-quality result is claimed." ], "license": { "label": "Apache-2.0", "url": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/transcribe/LICENSE.txt", "note": "Apache-2.0 license text inspected at this revision. Keep the license and any NOTICE when redistributing covered files. The services and accounts the skill uses have their own terms." }, "evidence": { "level": "source-reviewed", "reviewedOn": "2026-10-19", "revision": "49f948faa9258a0c61caceaf225e179651397431", "scope": [ "skills/.curated/transcribe/SKILL.md", "skills/.curated/transcribe/LICENSE.txt" ], "notTested": [ "Source review of SKILL.md and the per-skill license only. The bundled script and API reference file were not reviewed or run.", "No audio was transcribed. No accuracy or diarization-quality result is claimed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "source-review", "summary": "Completed 4 bounded source checks on the pinned entrypoint and license. No skill workflow was executed.", "environment": [ "Pinned public UTF-8 sources fetched from raw.githubusercontent.com at the recorded commit and hashed with SHA-256.", "Linux; Python 3.13.5 source-condition check. No account, credentials, private documents or live business data." ], "commands": [ "Read each pinned file listed in sourceManifest.", "python3 r6_skills.py: check each recorded source condition and reconcile report counts." ], "results": { "passed": 4, "failed": 0, "total": 4 }, "findings": [ { "severity": "attention", "title": "Recordings leave your machine", "detail": "The script uploads audio to OpenAI. Confirm that everyone recorded agreed to it and that the content may be processed by a third party." }, { "severity": "info", "title": "Key handling", "detail": "The skill says never to ask the user to paste the full key in chat." } ], "limitations": [ "Source review of SKILL.md and the per-skill license only. The bundled script and API reference file were not reviewed or run.", "No audio was transcribed. No accuracy or diarization-quality result is claimed." ], "artifact": "/skill-evaluations/openai-transcribe.json", "runAt": "2026-10-19" }, "popularity": { "basis": "GitHub displayed 28,155 stars for the openai/skills repository on the observation date. Repository-wide; not individual skill usage, quality or safety.", "url": "https://github.com/openai/skills", "observedOn": "2026-10-19", "value": 28155, "metric": "repository-stars", "scope": "Entire openai/skills repository, not this individual skill", "window": "Snapshot observed 2026-10-19" }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/transcribe/SKILL.md" }, { "label": "Pinned license", "url": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/transcribe/LICENSE.txt" }, { "label": "Repository (dated star count)", "url": "https://github.com/openai/skills" } ] }, { "id": "openai-security-threat-model", "name": "Security Threat Model", "owner": "OpenAI", "repository": "https://github.com/openai/skills", "skillPath": "skills/.curated/security-threat-model/SKILL.md", "sourceUrl": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/security-threat-model/SKILL.md", "category": "Security review", "summary": "Writes a repository-specific threat model: trust boundaries, assets, abuse paths and mitigations tied to evidence in the code.", "review": { "whatItIs": "This skill walks an agent through threat modeling a codebase. It maps components and entry points, lists the assets that matter, describes realistic attackers and ranks a small number of abuse paths by likelihood and impact. It must check its assumptions with you before writing the final report, which it saves as a Markdown file.", "whyUse": "Use it before launching an app or integration that handles customer data or credentials, when you want a focused list of what could go wrong rather than a generic checklist. It's a review aid, not an audit or penetration test.", "useCases": [ { "title": "Model a small web app", "example": "Threat model this repository. It is a booking app with a public form and an admin page. Ask me about deployment before you rank anything.", "expectedResult": "A Markdown threat model with boundaries, assets, ranked threats and mitigations, after a short round of questions.", "caveat": "Rankings depend on the answers you give. A wrong assumption about who can reach the admin page changes the result." }, { "title": "Check an integration path", "example": "Threat model only the webhooks/ folder, which receives payment events.", "expectedResult": "A scoped model of the webhook entry point and its trust boundary.", "caveat": "A scoped model doesn't cover the rest of the system. Note what was left out." } ] }, "bestFor": [ "Pre-launch review of apps that handle data or credentials", "Focused threat lists tied to the actual code" ], "requirements": [ "An agent with read access to the repository, and a person who can answer questions about deployment and users.", "No account or service is needed to read the code." ], "permissions": [ "Reads repository files in scope.", "Writes one Markdown threat-model file." ], "risks": [ { "title": "Not a security assurance", "severity": "attention", "detail": "The output is a model built from code reading and your answers. It doesn't test anything. Treat high-priority items as things to verify, not as findings." } ], "limitations": [ "Source review of SKILL.md and the per-skill license only. The reference prompt template and controls list were not reviewed.", "No repository was modeled. No accuracy or coverage result is claimed." ], "license": { "label": "Apache-2.0", "url": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/security-threat-model/LICENSE.txt", "note": "Apache-2.0 license text inspected at this revision. Keep the license and any NOTICE when redistributing covered files. The services and accounts the skill uses have their own terms." }, "evidence": { "level": "source-reviewed", "reviewedOn": "2026-10-19", "revision": "49f948faa9258a0c61caceaf225e179651397431", "scope": [ "skills/.curated/security-threat-model/SKILL.md", "skills/.curated/security-threat-model/LICENSE.txt" ], "notTested": [ "Source review of SKILL.md and the per-skill license only. The reference prompt template and controls list were not reviewed.", "No repository was modeled. No accuracy or coverage result is claimed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "source-review", "summary": "Completed 4 bounded source checks on the pinned entrypoint and license. No skill workflow was executed.", "environment": [ "Pinned public UTF-8 sources fetched from raw.githubusercontent.com at the recorded commit and hashed with SHA-256.", "Linux; Python 3.13.5 source-condition check. No account, credentials, private documents or live business data." ], "commands": [ "Read each pinned file listed in sourceManifest.", "python3 r6_skills.py: check each recorded source condition and reconcile report counts." ], "results": { "passed": 4, "failed": 0, "total": 4 }, "findings": [ { "severity": "attention", "title": "Not a security assurance", "detail": "The output is a model built from code reading and your answers. It doesn't test anything. Treat high-priority items as things to verify, not as findings." }, { "severity": "info", "title": "Pauses for your input", "detail": "The workflow stops to confirm assumptions before producing the final report." } ], "limitations": [ "Source review of SKILL.md and the per-skill license only. The reference prompt template and controls list were not reviewed.", "No repository was modeled. No accuracy or coverage result is claimed." ], "artifact": "/skill-evaluations/openai-security-threat-model.json", "runAt": "2026-10-19" }, "popularity": { "basis": "GitHub displayed 28,155 stars for the openai/skills repository on the observation date. Repository-wide; not individual skill usage, quality or safety.", "url": "https://github.com/openai/skills", "observedOn": "2026-10-19", "value": 28155, "metric": "repository-stars", "scope": "Entire openai/skills repository, not this individual skill", "window": "Snapshot observed 2026-10-19" }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/security-threat-model/SKILL.md" }, { "label": "Pinned license", "url": "https://github.com/openai/skills/blob/49f948faa9258a0c61caceaf225e179651397431/skills/.curated/security-threat-model/LICENSE.txt" }, { "label": "Repository (dated star count)", "url": "https://github.com/openai/skills" } ] }, { "id": "google-ads-api-account-diagnostics", "name": "Google Ads Account Diagnostics", "owner": "Google", "repository": "https://github.com/google/skills", "skillPath": "skills/ads/google-ads-api-account-diagnostics/SKILL.md", "sourceUrl": "https://github.com/google/skills/blob/e86adb9e2b80220a593c2be9a68627171fd17afb/skills/ads/google-ads-api-account-diagnostics/SKILL.md", "category": "Advertising & analytics", "summary": "Diagnoses drops in Google Ads conversions, leads and impression share with GAQL queries over Google's read-only Ads MCP server.", "review": { "whatItIs": "This skill gives an agent diagnostic routines for Google Ads accounts: conversion or conversion-value loss, low lead flow and impression share lost to budget or ad rank. It runs GAQL queries through the Google Ads MCP server's search tool, compares a recent period with a prior one, and checks change history and offline conversion uploads. Without the MCP server, it writes out the queries for you to run.", "whyUse": "Use it when an ad account's results drop and you want a structured first look at whether traffic, conversion rate, budget or ranking changed. It lists common query gotchas, such as cost reported in micros. Budget and bid decisions stay with you.", "useCases": [ { "title": "Explain a conversion drop", "example": "Conversions fell this week. Compare the last 7 days with the prior 7 by campaign and device, check impression share, and list recent change events. Don't suggest edits yet.", "expectedResult": "A short diagnosis naming which campaigns and devices changed and whether budget or rank limited impression share.", "caveat": "Ads and Analytics count conversions differently. Confirm the drop in the Google Ads interface before acting." }, { "title": "Check offline upload health", "example": "Check whether our offline conversion uploads are succeeding.", "expectedResult": "A per-action summary of successful versus total events and their status.", "caveat": "An empty result can simply mean the account doesn't use offline uploads." } ] }, "bestFor": [ "First-pass diagnosis of Google Ads performance drops", "Impression-share checks for budget and rank limits" ], "requirements": [ "The Google Ads MCP server (search, list_accessible_customers, get_resource_metadata), configured with Google Ads API access.", "Access to the client accounts being diagnosed." ], "permissions": [ "Reads account, campaign, change-event and upload-summary data through GAQL queries.", "The skill doesn't change campaigns. Any remediation is a separate step you take." ], "risks": [ { "title": "Recommendations still need judgment", "severity": "attention", "detail": "The skill maps high budget-lost or rank-lost impression share to raising budgets or improving bids and quality. Check margins and goals before spending more." } ], "limitations": [ "Source review of SKILL.md and the repository license only. The companion MCP setup skill was not reviewed.", "No Google Ads account was queried. No diagnostic accuracy result is claimed." ], "license": { "label": "Apache-2.0", "url": "https://github.com/google/skills/blob/e86adb9e2b80220a593c2be9a68627171fd17afb/LICENSE", "note": "Apache-2.0 license text inspected at this revision. Keep the license and any NOTICE when redistributing covered files. The services and accounts the skill uses have their own terms." }, "evidence": { "level": "source-reviewed", "reviewedOn": "2026-10-19", "revision": "e86adb9e2b80220a593c2be9a68627171fd17afb", "scope": [ "skills/ads/google-ads-api-account-diagnostics/SKILL.md", "LICENSE" ], "notTested": [ "Source review of SKILL.md and the repository license only. The companion MCP setup skill was not reviewed.", "No Google Ads account was queried. No diagnostic accuracy result is claimed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "source-review", "summary": "Completed 5 bounded source checks on the pinned entrypoint and license. No skill workflow was executed.", "environment": [ "Pinned public UTF-8 sources fetched from raw.githubusercontent.com at the recorded commit and hashed with SHA-256.", "Linux; Python 3.13.5 source-condition check. No account, credentials, private documents or live business data." ], "commands": [ "Read each pinned file listed in sourceManifest.", "python3 r6_skills.py: check each recorded source condition and reconcile report counts." ], "results": { "passed": 5, "failed": 0, "total": 5 }, "findings": [ { "severity": "attention", "title": "Recommendations still need judgment", "detail": "The skill maps high budget-lost or rank-lost impression share to raising budgets or improving bids and quality. Check margins and goals before spending more." }, { "severity": "info", "title": "No local probing", "detail": "Without the MCP server, the skill tells the agent not to try shell scripts or other workarounds to reach account data." } ], "limitations": [ "Source review of SKILL.md and the repository license only. The companion MCP setup skill was not reviewed.", "No Google Ads account was queried. No diagnostic accuracy result is claimed." ], "artifact": "/skill-evaluations/google-ads-api-account-diagnostics.json", "runAt": "2026-10-19" }, "popularity": { "basis": "GitHub displayed 21,407 stars for the google/skills repository on the observation date. Repository-wide; not individual skill usage, quality or safety.", "url": "https://github.com/google/skills", "observedOn": "2026-10-19", "value": 21407, "metric": "repository-stars", "scope": "Entire google/skills repository, not this individual skill", "window": "Snapshot observed 2026-10-19" }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/google/skills/blob/e86adb9e2b80220a593c2be9a68627171fd17afb/skills/ads/google-ads-api-account-diagnostics/SKILL.md" }, { "label": "Pinned license", "url": "https://github.com/google/skills/blob/e86adb9e2b80220a593c2be9a68627171fd17afb/LICENSE" }, { "label": "Repository (dated star count)", "url": "https://github.com/google/skills" } ] }, { "id": "google-analytics-data-api-basics", "name": "Google Analytics Data API Basics", "owner": "Google", "repository": "https://github.com/google/skills", "skillPath": "skills/analytics/google-analytics-data-api-basics/SKILL.md", "sourceUrl": "https://github.com/google/skills/blob/e86adb9e2b80220a593c2be9a68627171fd17afb/skills/analytics/google-analytics-data-api-basics/SKILL.md", "category": "Advertising & analytics", "summary": "Sets up and runs Google Analytics 4 reports through the Data API v1beta, with read-only scopes and a field compatibility check.", "review": { "whatItIs": "This skill covers enabling the Google Analytics Data API with the gcloud CLI, signing in with Application Default Credentials and a read-only Analytics scope, and running reports with the official client libraries. It lists common dimensions and metrics and shows how to check that a set of fields can be queried together.", "whyUse": "Use it when you want an agent to pull GA4 numbers into a script or report instead of copying them from the interface. It's developer-oriented: you need a Google Cloud project and a language runtime.", "useCases": [ { "title": "Weekly traffic by source", "example": "Write a Python script that reports sessions and key events by session source for the last 7 days on property 123456, and print a table.", "expectedResult": "A runnable script using the Data API client and a table of results.", "caveat": "Check the totals against the GA4 interface. Sampling, thresholds and date ranges can make them differ." }, { "title": "Check field compatibility", "example": "Before building the report, check that itemName, activeUsers and totalRevenue can be queried together.", "expectedResult": "A compatibility result for each field.", "caveat": "Compatibility doesn't mean the numbers mean what you expect. Define each metric first." } ] }, "bestFor": [ "Scripted GA4 reports", "Checking metric and dimension combinations before building a report" ], "requirements": [ "A Google Cloud project with the Analytics Data API enabled, the gcloud CLI, and access to the GA4 property.", "A language runtime and client library (Python, Node.js, Java, PHP, Go, .NET or Ruby)." ], "permissions": [ "Enables an API in your Google Cloud project and creates local Application Default Credentials.", "Reads report data with the analytics.readonly scope." ], "risks": [ { "title": "Local credentials are broader than Analytics", "severity": "attention", "detail": "The login command also requests the cloud-platform scope. Use a dedicated project and account where possible, and revoke the credentials when finished." } ], "limitations": [ "Source review of SKILL.md and the repository license only. The per-language reference files were not reviewed.", "No API was enabled and no report was run. No result accuracy is claimed." ], "license": { "label": "Apache-2.0", "url": "https://github.com/google/skills/blob/e86adb9e2b80220a593c2be9a68627171fd17afb/LICENSE", "note": "Apache-2.0 license text inspected at this revision. Keep the license and any NOTICE when redistributing covered files. The services and accounts the skill uses have their own terms." }, "evidence": { "level": "source-reviewed", "reviewedOn": "2026-10-19", "revision": "e86adb9e2b80220a593c2be9a68627171fd17afb", "scope": [ "skills/analytics/google-analytics-data-api-basics/SKILL.md", "LICENSE" ], "notTested": [ "Source review of SKILL.md and the repository license only. The per-language reference files were not reviewed.", "No API was enabled and no report was run. No result accuracy is claimed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "source-review", "summary": "Completed 5 bounded source checks on the pinned entrypoint and license. No skill workflow was executed.", "environment": [ "Pinned public UTF-8 sources fetched from raw.githubusercontent.com at the recorded commit and hashed with SHA-256.", "Linux; Python 3.13.5 source-condition check. No account, credentials, private documents or live business data." ], "commands": [ "Read each pinned file listed in sourceManifest.", "python3 r6_skills.py: check each recorded source condition and reconcile report counts." ], "results": { "passed": 5, "failed": 0, "total": 5 }, "findings": [ { "severity": "attention", "title": "Local credentials are broader than Analytics", "detail": "The login command also requests the cloud-platform scope. Use a dedicated project and account where possible, and revoke the credentials when finished." }, { "severity": "info", "title": "Read-only Analytics scope", "detail": "The documented login requests the analytics.readonly scope." } ], "limitations": [ "Source review of SKILL.md and the repository license only. The per-language reference files were not reviewed.", "No API was enabled and no report was run. No result accuracy is claimed." ], "artifact": "/skill-evaluations/google-analytics-data-api-basics.json", "runAt": "2026-10-19" }, "popularity": { "basis": "GitHub displayed 21,407 stars for the google/skills repository on the observation date. Repository-wide; not individual skill usage, quality or safety.", "url": "https://github.com/google/skills", "observedOn": "2026-10-19", "value": 21407, "metric": "repository-stars", "scope": "Entire google/skills repository, not this individual skill", "window": "Snapshot observed 2026-10-19" }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/google/skills/blob/e86adb9e2b80220a593c2be9a68627171fd17afb/skills/analytics/google-analytics-data-api-basics/SKILL.md" }, { "label": "Pinned license", "url": "https://github.com/google/skills/blob/e86adb9e2b80220a593c2be9a68627171fd17afb/LICENSE" }, { "label": "Repository (dated star count)", "url": "https://github.com/google/skills" } ] }, { "id": "cloudflare-web-perf", "name": "Web Performance Audit", "owner": "Cloudflare", "repository": "https://github.com/cloudflare/skills", "skillPath": "skills/web-perf/SKILL.md", "sourceUrl": "https://github.com/cloudflare/skills/blob/86505e44f87d801aa1864a3c4109e9a8ae5c409f/skills/web-perf/SKILL.md", "category": "Engineering", "summary": "A five-phase page-speed audit using Chrome DevTools MCP traces, network analysis, an accessibility snapshot and a codebase check.", "review": { "whatItIs": "Web Perf guides an agent through auditing a page: record a performance trace, read Core Web Vitals insights, review network requests for blocking or oversized resources, take an accessibility snapshot, and, if the code is available, look at the build setup. It tells the agent to check current thresholds against web.dev and Chrome documentation instead of relying on memory.", "whyUse": "Use it when a marketing site or app feels slow and you want specific, measured fixes rather than generic advice. It asks for findings with estimated impact and says to skip changes with no measurable effect.", "useCases": [ { "title": "Audit a landing page", "example": "Audit https://example.com/pricing for load performance. Report Core Web Vitals, the top three issues by estimated impact and specific fixes.", "expectedResult": "A vitals table, a ranked issue list and concrete fixes.", "caveat": "A single lab trace isn't field data. Confirm improvements with real-user measurements where you have them." }, { "title": "Check a build for heavy bundles", "example": "We have the repo. After the trace, check the bundler config for minification, compression and oversized libraries.", "expectedResult": "Codebase findings tied to the trace results.", "caveat": "Recommendations to remove code need checking. The skill itself says to confirm something is unused before removing it." } ] }, "bestFor": [ "Page-speed audits with measured evidence", "Linking trace findings to build configuration" ], "requirements": [ "An agent with browser tooling, ideally Chrome DevTools MCP, for traces and network data.", "Codebase access for the optional fifth phase." ], "permissions": [ "Loads pages in a browser and records traces and network data.", "Reads project configuration files when a codebase is provided. MCP configuration changes need your authorization." ], "risks": [ { "title": "Lab numbers are not user experience", "severity": "attention", "detail": "Traces come from one controlled load. Treat the thresholds and estimates as guides and verify them with field data before claiming gains." } ], "limitations": [ "Source review of SKILL.md and the repository license only.", "No page was traced and no code was analyzed. No performance result is claimed." ], "license": { "label": "Apache-2.0", "url": "https://github.com/cloudflare/skills/blob/86505e44f87d801aa1864a3c4109e9a8ae5c409f/LICENSE", "note": "Apache-2.0 license text inspected at this revision. Keep the license and any NOTICE when redistributing covered files. The services and accounts the skill uses have their own terms." }, "evidence": { "level": "source-reviewed", "reviewedOn": "2026-10-19", "revision": "86505e44f87d801aa1864a3c4109e9a8ae5c409f", "scope": [ "skills/web-perf/SKILL.md", "LICENSE" ], "notTested": [ "Source review of SKILL.md and the repository license only.", "No page was traced and no code was analyzed. No performance result is claimed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "source-review", "summary": "Completed 4 bounded source checks on the pinned entrypoint and license. No skill workflow was executed.", "environment": [ "Pinned public UTF-8 sources fetched from raw.githubusercontent.com at the recorded commit and hashed with SHA-256.", "Linux; Python 3.13.5 source-condition check. No account, credentials, private documents or live business data." ], "commands": [ "Read each pinned file listed in sourceManifest.", "python3 r6_skills.py: check each recorded source condition and reconcile report counts." ], "results": { "passed": 4, "failed": 0, "total": 4 }, "findings": [ { "severity": "attention", "title": "Lab numbers are not user experience", "detail": "Traces come from one controlled load. Treat the thresholds and estimates as guides and verify them with field data before claiming gains." }, { "severity": "info", "title": "Retrieval over memory", "detail": "The skill tells the agent to fetch current thresholds and scoring rules rather than rely on pre-training." } ], "limitations": [ "Source review of SKILL.md and the repository license only.", "No page was traced and no code was analyzed. No performance result is claimed." ], "artifact": "/skill-evaluations/cloudflare-web-perf.json", "runAt": "2026-10-19" }, "popularity": { "basis": "GitHub displayed 3,100 stars for the cloudflare/skills repository on the observation date. Repository-wide; not individual skill usage, quality or safety.", "url": "https://github.com/cloudflare/skills", "observedOn": "2026-10-19", "value": 3100, "metric": "repository-stars", "scope": "Entire cloudflare/skills repository, not this individual skill", "window": "Snapshot observed 2026-10-19" }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/cloudflare/skills/blob/86505e44f87d801aa1864a3c4109e9a8ae5c409f/skills/web-perf/SKILL.md" }, { "label": "Pinned license", "url": "https://github.com/cloudflare/skills/blob/86505e44f87d801aa1864a3c4109e9a8ae5c409f/LICENSE" }, { "label": "Repository (dated star count)", "url": "https://github.com/cloudflare/skills" } ] }, { "id": "huggingface-community-evals", "name": "Hugging Face Community Evals", "owner": "Hugging Face", "repository": "https://github.com/huggingface/skills", "skillPath": "skills/huggingface-community-evals/SKILL.md", "sourceUrl": "https://github.com/huggingface/skills/blob/c3ff942be3e07116b475253f0a8fc4f54682c1a8/skills/huggingface-community-evals/SKILL.md", "category": "Evaluation", "summary": "Runs benchmark evaluations of Hub models locally with inspect-ai or lighteval, starting from small smoke tests.", "review": { "whatItIs": "This skill helps an agent evaluate models from the Hugging Face Hub on local hardware or through Inference Providers. It chooses between inspect-ai and lighteval, picks an inference backend (vLLM, Transformers or accelerate), and starts with a small sample before a full run. It stops at local runs and hands off remote jobs and result publishing to other skills.", "whyUse": "Use it when you're comparing open models for a task and want standard benchmark numbers from your own run. For business tasks, a small set of your own test cases usually tells you more than public benchmarks.", "useCases": [ { "title": "Smoke-test a model", "example": "Run a 20-sample MMLU smoke test on meta-llama/Llama-3.2-1B using inspect-ai through Inference Providers.", "expectedResult": "A small benchmark result and the command used.", "caveat": "Twenty samples is a smoke test, not a score. Don't compare models on it." }, { "title": "Compare two small models on GPU", "example": "Run gsm8k with 50 samples on two models using vLLM, and report both scores with the same settings.", "expectedResult": "Two scores from matched settings.", "caveat": "Benchmark scores may not reflect your use case. Add your own test cases before choosing." } ] }, "bestFor": [ "Local benchmark runs on open models", "Choosing an inference backend for evaluation" ], "requirements": [ "uv, the bundled Python scripts, and an HF_TOKEN for gated or private models.", "A local GPU for vLLM or Transformers runs, or Inference Providers for the lighter path." ], "permissions": [ "Runs local scripts that download models and datasets.", "Uses your Hugging Face token. The provider path sends prompts to inference providers." ], "risks": [ { "title": "Remote code flag", "severity": "attention", "detail": "Examples use --trust-remote-code for some models, which runs code from the model repository. Only use it for models you trust." } ], "limitations": [ "Source review of SKILL.md and the repository license only. The three bundled scripts and usage examples were not reviewed or run.", "No model was evaluated. No benchmark result is claimed." ], "license": { "label": "Apache-2.0", "url": "https://github.com/huggingface/skills/blob/c3ff942be3e07116b475253f0a8fc4f54682c1a8/LICENSE", "note": "Apache-2.0 license text inspected at this revision. Keep the license and any NOTICE when redistributing covered files. The services and accounts the skill uses have their own terms." }, "evidence": { "level": "source-reviewed", "reviewedOn": "2026-10-19", "revision": "c3ff942be3e07116b475253f0a8fc4f54682c1a8", "scope": [ "skills/huggingface-community-evals/SKILL.md", "LICENSE" ], "notTested": [ "Source review of SKILL.md and the repository license only. The three bundled scripts and usage examples were not reviewed or run.", "No model was evaluated. No benchmark result is claimed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "source-review", "summary": "Completed 4 bounded source checks on the pinned entrypoint and license. No skill workflow was executed.", "environment": [ "Pinned public UTF-8 sources fetched from raw.githubusercontent.com at the recorded commit and hashed with SHA-256.", "Linux; Python 3.13.5 source-condition check. No account, credentials, private documents or live business data." ], "commands": [ "Read each pinned file listed in sourceManifest.", "python3 r6_skills.py: check each recorded source condition and reconcile report counts." ], "results": { "passed": 4, "failed": 0, "total": 4 }, "findings": [ { "severity": "attention", "title": "Remote code flag", "detail": "Examples use --trust-remote-code for some models, which runs code from the model repository. Only use it for models you trust." }, { "severity": "info", "title": "Clear boundary", "detail": "The skill states what it does not cover, including remote jobs and publishing results." } ], "limitations": [ "Source review of SKILL.md and the repository license only. The three bundled scripts and usage examples were not reviewed or run.", "No model was evaluated. No benchmark result is claimed." ], "artifact": "/skill-evaluations/huggingface-community-evals.json", "runAt": "2026-10-19" }, "popularity": { "basis": "GitHub displayed 11,182 stars for the huggingface/skills repository on the observation date. Repository-wide; not individual skill usage, quality or safety.", "url": "https://github.com/huggingface/skills", "observedOn": "2026-10-19", "value": 11182, "metric": "repository-stars", "scope": "Entire huggingface/skills repository, not this individual skill", "window": "Snapshot observed 2026-10-19" }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/huggingface/skills/blob/c3ff942be3e07116b475253f0a8fc4f54682c1a8/skills/huggingface-community-evals/SKILL.md" }, { "label": "Pinned license", "url": "https://github.com/huggingface/skills/blob/c3ff942be3e07116b475253f0a8fc4f54682c1a8/LICENSE" }, { "label": "Repository (dated star count)", "url": "https://github.com/huggingface/skills" } ] }, { "id": "sentry-skill-scanner", "name": "Skill Scanner", "owner": "Sentry", "repository": "https://github.com/getsentry/skills", "skillPath": "skills/skill-scanner/SKILL.md", "sourceUrl": "https://github.com/getsentry/skills/blob/f57ada2d0b640406ea7e25b11d636c530e77c58b/skills/skill-scanner/SKILL.md", "category": "Security review", "summary": "Reviews an agent skill before you install it, with a static scan script plus checks for injection, risky scripts, permissions and supply-chain links.", "review": { "whatItIs": "Skill Scanner runs a bundled Python scanner on a skill folder, then has the agent review the results: frontmatter, prompt-injection patterns, whether instructions match the description, scripts, external URLs and requested tools. It ends with a rating and an install recommendation. It warns that security-related skills often mention attack patterns legitimately.", "whyUse": "Use it as a first pass before adding a third-party skill to an agent that can read files or run commands. It complements reading the skill yourself; it does not replace it.", "useCases": [ { "title": "Scan a downloaded skill", "example": "Scan the skill in ./downloads/report-builder before I install it. Explain each finding in plain language.", "expectedResult": "A findings list with severity and confidence, and an install recommendation.", "caveat": "A clean scan doesn't prove a skill is safe. Read any scripts yourself before granting shell access." }, { "title": "Check a skill for config changes", "example": "Check whether this skill tries to modify agent settings, memory files or hooks.", "expectedResult": "A short answer pointing to any lines that write to agent configuration.", "caveat": "Pattern checks can miss obfuscated behavior. Treat no findings as unknown, not safe." } ] }, "bestFor": [ "Pre-install review of third-party skills", "Spotting skills that change agent configuration" ], "requirements": [ "uv for the bundled scanner script, and an agent with Read, Grep, Glob and Bash.", "A local copy of the skill to scan." ], "permissions": [ "Reads the target skill folder and runs the bundled scanner script.", "The skill itself requests Bash. Run it on untrusted skills in a disposable environment." ], "risks": [ { "title": "The scanner runs code on your machine", "severity": "attention", "detail": "Scanning uses a bundled script and requests Bash. Review the script or run it in a sandbox before scanning untrusted material." }, { "title": "No findings is not proof of safety", "severity": "attention", "detail": "Static patterns and model review can both miss malicious behavior. Keep reading scripts and limiting tool access." } ], "limitations": [ "Source review of SKILL.md and the repository license only. The scanner script and its reference pattern files were not reviewed or run.", "No skill was scanned. No detection-rate result is claimed." ], "license": { "label": "Apache-2.0", "url": "https://github.com/getsentry/skills/blob/f57ada2d0b640406ea7e25b11d636c530e77c58b/LICENSE", "note": "Apache-2.0 license text inspected at this revision. Keep the license and any NOTICE when redistributing covered files. The services and accounts the skill uses have their own terms." }, "evidence": { "level": "source-reviewed", "reviewedOn": "2026-10-19", "revision": "f57ada2d0b640406ea7e25b11d636c530e77c58b", "scope": [ "skills/skill-scanner/SKILL.md", "LICENSE" ], "notTested": [ "Source review of SKILL.md and the repository license only. The scanner script and its reference pattern files were not reviewed or run.", "No skill was scanned. No detection-rate result is claimed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "source-review", "summary": "Completed 4 bounded source checks on the pinned entrypoint and license. No skill workflow was executed.", "environment": [ "Pinned public UTF-8 sources fetched from raw.githubusercontent.com at the recorded commit and hashed with SHA-256.", "Linux; Python 3.13.5 source-condition check. No account, credentials, private documents or live business data." ], "commands": [ "Read each pinned file listed in sourceManifest.", "python3 r6_skills.py: check each recorded source condition and reconcile report counts." ], "results": { "passed": 4, "failed": 0, "total": 4 }, "findings": [ { "severity": "attention", "title": "The scanner runs code on your machine", "detail": "Scanning uses a bundled script and requests Bash. Review the script or run it in a sandbox before scanning untrusted material." }, { "severity": "attention", "title": "No findings is not proof of safety", "detail": "Static patterns and model review can both miss malicious behavior. Keep reading scripts and limiting tool access." }, { "severity": "info", "title": "False positives addressed", "detail": "The skill tells the agent to judge intent, since security skills may document attack patterns." } ], "limitations": [ "Source review of SKILL.md and the repository license only. The scanner script and its reference pattern files were not reviewed or run.", "No skill was scanned. No detection-rate result is claimed." ], "artifact": "/skill-evaluations/sentry-skill-scanner.json", "runAt": "2026-10-19" }, "popularity": { "basis": "GitHub displayed 1,066 stars for the getsentry/skills repository on the observation date. Repository-wide; not individual skill usage, quality or safety.", "url": "https://github.com/getsentry/skills", "observedOn": "2026-10-19", "value": 1066, "metric": "repository-stars", "scope": "Entire getsentry/skills repository, not this individual skill", "window": "Snapshot observed 2026-10-19" }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/getsentry/skills/blob/f57ada2d0b640406ea7e25b11d636c530e77c58b/skills/skill-scanner/SKILL.md" }, { "label": "Pinned license", "url": "https://github.com/getsentry/skills/blob/f57ada2d0b640406ea7e25b11d636c530e77c58b/LICENSE" }, { "label": "Repository (dated star count)", "url": "https://github.com/getsentry/skills" } ] }, { "id": "sentry-prompt-optimizer", "name": "Prompt Optimizer", "owner": "Sentry", "repository": "https://github.com/getsentry/skills", "skillPath": "skills/prompt-optimizer/SKILL.md", "sourceUrl": "https://github.com/getsentry/skills/blob/f57ada2d0b640406ea7e25b11d636c530e77c58b/skills/prompt-optimizer/SKILL.md", "category": "Evaluation", "summary": "Improves prompts against a small eval set: define success first, try a few candidate rewrites, keep the one that wins on held-out cases.", "review": { "whatItIs": "Prompt Optimizer has the agent record what a prompt is for, what good output looks like and how it fails before editing anything. If there are no examples, it builds a small eval set first. It then tries two to four candidate rewrites, compares them on the same cases, logs the changes and checks the winner on held-out cases. It covers porting prompts between model families.", "whyUse": "Use it for prompts you rely on repeatedly, such as a support reply template or a summarizer, where you can say what a good answer is. It's more work than a quick rewrite, and it's meant to be.", "useCases": [ { "title": "Tighten a support reply prompt", "example": "Improve this support reply system prompt. Build 10 test cases from these anonymized tickets, compare two candidates and report which wins on 3 held-out cases.", "expectedResult": "An optimized prompt, the eval set, an optimization log and remaining risks.", "caveat": "Small eval sets overfit easily. Re-check with fresh tickets before rolling it out." }, { "title": "Port a prompt to another model", "example": "Adapt this summarizer prompt from one model family to another and note what changed.", "expectedResult": "A base prompt plus model-specific adapter notes.", "caveat": "Model snapshots change. Rerun the eval set when the model updates." } ] }, "bestFor": [ "Prompts used repeatedly where quality can be defined", "Moving a prompt between model families" ], "requirements": [ "An agent that can read the bundled reference files.", "Example inputs and success criteria, or time to build a small eval set." ], "permissions": [ "Reads the prompt and any context files you name.", "Writes prompt drafts and an eval set. It does not deploy anything." ], "risks": [ { "title": "Eval data can contain personal details", "severity": "attention", "detail": "Test cases built from real tickets or emails can carry personal data into prompts and logs. Anonymize them first." } ], "limitations": [ "Source review of SKILL.md and the repository license only. The reference files and SPEC.md were not reviewed.", "No prompt was optimized. No improvement result is claimed." ], "license": { "label": "Apache-2.0", "url": "https://github.com/getsentry/skills/blob/f57ada2d0b640406ea7e25b11d636c530e77c58b/LICENSE", "note": "Apache-2.0 license text inspected at this revision. Keep the license and any NOTICE when redistributing covered files. The services and accounts the skill uses have their own terms." }, "evidence": { "level": "source-reviewed", "reviewedOn": "2026-10-19", "revision": "f57ada2d0b640406ea7e25b11d636c530e77c58b", "scope": [ "skills/prompt-optimizer/SKILL.md", "LICENSE" ], "notTested": [ "Source review of SKILL.md and the repository license only. The reference files and SPEC.md were not reviewed.", "No prompt was optimized. No improvement result is claimed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "source-review", "summary": "Completed 4 bounded source checks on the pinned entrypoint and license. No skill workflow was executed.", "environment": [ "Pinned public UTF-8 sources fetched from raw.githubusercontent.com at the recorded commit and hashed with SHA-256.", "Linux; Python 3.13.5 source-condition check. No account, credentials, private documents or live business data." ], "commands": [ "Read each pinned file listed in sourceManifest.", "python3 r6_skills.py: check each recorded source condition and reconcile report counts." ], "results": { "passed": 4, "failed": 0, "total": 4 }, "findings": [ { "severity": "attention", "title": "Eval data can contain personal details", "detail": "Test cases built from real tickets or emails can carry personal data into prompts and logs. Anonymize them first." }, { "severity": "info", "title": "Stops on non-prompt problems", "detail": "The skill says to stop and report when the bottleneck is model choice, retrieval or tool design rather than wording." } ], "limitations": [ "Source review of SKILL.md and the repository license only. The reference files and SPEC.md were not reviewed.", "No prompt was optimized. No improvement result is claimed." ], "artifact": "/skill-evaluations/sentry-prompt-optimizer.json", "runAt": "2026-10-19" }, "popularity": { "basis": "GitHub displayed 1,066 stars for the getsentry/skills repository on the observation date. Repository-wide; not individual skill usage, quality or safety.", "url": "https://github.com/getsentry/skills", "observedOn": "2026-10-19", "value": 1066, "metric": "repository-stars", "scope": "Entire getsentry/skills repository, not this individual skill", "window": "Snapshot observed 2026-10-19" }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/getsentry/skills/blob/f57ada2d0b640406ea7e25b11d636c530e77c58b/skills/prompt-optimizer/SKILL.md" }, { "label": "Pinned license", "url": "https://github.com/getsentry/skills/blob/f57ada2d0b640406ea7e25b11d636c530e77c58b/LICENSE" }, { "label": "Repository (dated star count)", "url": "https://github.com/getsentry/skills" } ] }, { "id": "supabase-platform", "name": "Supabase", "owner": "Supabase", "repository": "https://github.com/supabase/agent-skills", "skillPath": "skills/supabase/SKILL.md", "sourceUrl": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase/SKILL.md", "category": "Databases", "summary": "Supabase's general skill for agents: check current docs first, verify every fix, and follow a security checklist for auth, RLS, keys and storage.", "review": { "whatItIs": "This is Supabase's broad skill for any Supabase task: database, auth, Edge Functions, storage and client libraries. It tells the agent to check the changelog and current docs before implementing, to run a test after every fix, and to stop retrying after a few failed attempts. A security checklist covers common traps, such as views that bypass row-level security and keys exposed in frontend code.", "whyUse": "Use it when an agent builds or changes a Supabase project, alongside the narrower Postgres best-practices skill. The checklist is the most useful part for small teams without a dedicated security reviewer.", "useCases": [ { "title": "Add a table safely", "example": "Add a bookings table with row-level security so each signed-in user sees only their own rows. Test both an allowed and a denied read.", "expectedResult": "A migration, policies combining role and ownership, and two test results.", "caveat": "Test with real user roles in a non-production project. A passing policy review isn't a passing test." }, { "title": "Fix an inaccessible table", "example": "A table I created in SQL isn't reachable from the app. Check the Data API settings and grants before changing anything.", "expectedResult": "A diagnosis naming the missing exposure or grant, and a proposed fix.", "caveat": "Granting anon access exposes data publicly. Enable row-level security before any public grant." } ] }, "bestFor": [ "Building or changing Supabase projects with an agent", "A security checklist for auth, RLS, keys and storage" ], "requirements": [ "A Supabase project and either the Supabase CLI or the Supabase MCP server.", "A scoped personal access token for CI or agents, per the skill." ], "permissions": [ "Reads docs and project files, and runs SQL or CLI commands against the connected project.", "Schema changes, grants and policies change the database. Use a development project first." ], "risks": [ { "title": "SQL runs with real privileges", "severity": "high", "detail": "The skill uses execute_sql and CLI commands that change schemas and policies. Point it at a development project and review migrations before they reach production." }, { "title": "Login tokens can be broader than needed", "severity": "attention", "detail": "The skill notes that the CLI browser login creates a full-access token. Use scoped tokens for agents and CI." } ], "limitations": [ "Source review of SKILL.md and the repository license only. Linked Supabase docs were not reviewed.", "No Supabase project was connected and no SQL was run. No security guarantee is claimed." ], "license": { "label": "MIT", "url": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/LICENSE", "note": "MIT license text inspected at this revision. Keep the copyright and permission notice when redistributing covered files. The services and accounts the skill uses have their own terms." }, "evidence": { "level": "source-reviewed", "reviewedOn": "2026-10-19", "revision": "c9be0e931b7930f7d02126d04774d904c381e7d7", "scope": [ "skills/supabase/SKILL.md", "LICENSE" ], "notTested": [ "Source review of SKILL.md and the repository license only. Linked Supabase docs were not reviewed.", "No Supabase project was connected and no SQL was run. No security guarantee is claimed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "source-review", "summary": "Completed 5 bounded source checks on the pinned entrypoint and license. No skill workflow was executed.", "environment": [ "Pinned public UTF-8 sources fetched from raw.githubusercontent.com at the recorded commit and hashed with SHA-256.", "Linux; Python 3.13.5 source-condition check. No account, credentials, private documents or live business data." ], "commands": [ "Read each pinned file listed in sourceManifest.", "python3 r6_skills.py: check each recorded source condition and reconcile report counts." ], "results": { "passed": 5, "failed": 0, "total": 5 }, "findings": [ { "severity": "high", "title": "SQL runs with real privileges", "detail": "The skill uses execute_sql and CLI commands that change schemas and policies. Point it at a development project and review migrations before they reach production." }, { "severity": "attention", "title": "Login tokens can be broader than needed", "detail": "The skill notes that the CLI browser login creates a full-access token. Use scoped tokens for agents and CI." }, { "severity": "info", "title": "Verify every fix", "detail": "The skill treats a fix without a test query as incomplete." } ], "limitations": [ "Source review of SKILL.md and the repository license only. Linked Supabase docs were not reviewed.", "No Supabase project was connected and no SQL was run. No security guarantee is claimed." ], "artifact": "/skill-evaluations/supabase-platform.json", "runAt": "2026-10-19" }, "popularity": { "basis": "GitHub displayed 2,879 stars for the supabase/agent-skills repository on the observation date. Repository-wide; not individual skill usage, quality or safety.", "url": "https://github.com/supabase/agent-skills", "observedOn": "2026-10-19", "value": 2879, "metric": "repository-stars", "scope": "Entire supabase/agent-skills repository, not this individual skill", "window": "Snapshot observed 2026-10-19" }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase/SKILL.md" }, { "label": "Pinned license", "url": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/LICENSE" }, { "label": "Repository (dated star count)", "url": "https://github.com/supabase/agent-skills" } ] }, { "id": "microsoft-learn-docs", "name": "Microsoft Docs", "owner": "Microsoft", "repository": "https://github.com/microsoft/skills", "skillPath": ".github/skills/microsoft-docs/SKILL.md", "sourceUrl": "https://github.com/microsoft/skills/blob/8850874f66fb4d905bfcfcb923a18883bb70d1cd/.github/skills/microsoft-docs/SKILL.md", "category": "Development", "summary": "Answers questions about Microsoft products from live Microsoft Learn documentation, through the Learn MCP server or the mslearn CLI.", "review": { "whatItIs": "This skill tells an agent to look up Microsoft documentation rather than answer from memory. It uses the Microsoft Learn MCP server's search and fetch tools, or the mslearn command-line tool if MCP isn't available. It covers concepts, tutorials, configuration options, limits and quotas across Azure, Microsoft 365, Windows, .NET and Power Platform.", "whyUse": "Use it when you or an agent need current Microsoft limits, settings or setup steps and want the answer tied to an official page. It encourages specific queries that include version and platform.", "useCases": [ { "title": "Check a service limit", "example": "What is the current maximum timeout for Azure Functions on the Consumption plan? Cite the Microsoft Learn page.", "expectedResult": "An answer with the documentation link it came from.", "caveat": "Docs can lag product changes. Check the page date, and confirm in your tenant or subscription settings." }, { "title": "Follow a setup tutorial", "example": "Find the Microsoft Learn quickstart for creating a SharePoint site and list the steps in order.", "expectedResult": "A step list taken from the fetched page.", "caveat": "Steps depend on your plan and admin rights. The docs can't tell you what your tenant allows." } ] }, "bestFor": [ "Current answers about Microsoft products with an official source", "Setup steps and limits from Microsoft Learn" ], "requirements": [ "The Microsoft Learn MCP server at learn.microsoft.com/api/mcp, or Node.js for the mslearn CLI.", "No Microsoft account is needed to search public documentation." ], "permissions": [ "Sends search queries to Microsoft Learn and fetches public pages.", "The CLI fallback runs an npm package with npx." ], "risks": [ { "title": "The CLI fallback runs a downloaded package", "severity": "attention", "detail": "Running npx @microsoft/learn-cli fetches and runs code from npm. Pin a version or install it deliberately rather than running it ad hoc." } ], "limitations": [ "Source review of SKILL.md and the repository license only.", "No query was run and no CLI was installed. No answer-accuracy result is claimed." ], "license": { "label": "MIT", "url": "https://github.com/microsoft/skills/blob/8850874f66fb4d905bfcfcb923a18883bb70d1cd/LICENSE", "note": "MIT license text inspected at this revision. Keep the copyright and permission notice when redistributing covered files. The services and accounts the skill uses have their own terms." }, "evidence": { "level": "source-reviewed", "reviewedOn": "2026-10-19", "revision": "8850874f66fb4d905bfcfcb923a18883bb70d1cd", "scope": [ ".github/skills/microsoft-docs/SKILL.md", "LICENSE" ], "notTested": [ "Source review of SKILL.md and the repository license only.", "No query was run and no CLI was installed. No answer-accuracy result is claimed." ] }, "relationship": "explored", "evaluation": { "status": "completed", "kind": "source-review", "summary": "Completed 4 bounded source checks on the pinned entrypoint and license. No skill workflow was executed.", "environment": [ "Pinned public UTF-8 sources fetched from raw.githubusercontent.com at the recorded commit and hashed with SHA-256.", "Linux; Python 3.13.5 source-condition check. No account, credentials, private documents or live business data." ], "commands": [ "Read each pinned file listed in sourceManifest.", "python3 r6_skills.py: check each recorded source condition and reconcile report counts." ], "results": { "passed": 4, "failed": 0, "total": 4 }, "findings": [ { "severity": "attention", "title": "The CLI fallback runs a downloaded package", "detail": "Running npx @microsoft/learn-cli fetches and runs code from npm. Pin a version or install it deliberately rather than running it ad hoc." }, { "severity": "info", "title": "Official source first", "detail": "The skill prefers live documentation over training data." } ], "limitations": [ "Source review of SKILL.md and the repository license only.", "No query was run and no CLI was installed. No answer-accuracy result is claimed." ], "artifact": "/skill-evaluations/microsoft-learn-docs.json", "runAt": "2026-10-19" }, "popularity": { "basis": "GitHub displayed 3,131 stars for the microsoft/skills repository on the observation date. Repository-wide; not individual skill usage, quality or safety.", "url": "https://github.com/microsoft/skills", "observedOn": "2026-10-19", "value": 3131, "metric": "repository-stars", "scope": "Entire microsoft/skills repository, not this individual skill", "window": "Snapshot observed 2026-10-19" }, "sources": [ { "label": "Pinned skill instructions", "url": "https://github.com/microsoft/skills/blob/8850874f66fb4d905bfcfcb923a18883bb70d1cd/.github/skills/microsoft-docs/SKILL.md" }, { "label": "Pinned license", "url": "https://github.com/microsoft/skills/blob/8850874f66fb4d905bfcfcb923a18883bb70d1cd/LICENSE" }, { "label": "Repository (dated star count)", "url": "https://github.com/microsoft/skills" } ] } ] }