Methodology

What's scanned

Every skill and plugin that the Agent Skills Index lists from a catalog repository: 871 entries from 7 catalogs (see the sources page for repositories and commits). Entries that live in their authors' own repositories (2,623 of 3,495) aren't scanned yet. For plugins we read the whole plugin folder plus the skills, agents and extensions its manifest points to elsewhere in the repository.

How

A script clones each catalog at a fixed commit and reads the files. Nothing is installed or run. It looks at:

• Pre-approved tools: the allowed-tools list in SKILL.md, command and agent frontmatter, and the tools list of agent files. Bash or Bash(*) counts as "any command"; a pattern like Bash(git:*) counts as scoped.
• Hooks: hooks/hooks.json and hooks declared in the plugin manifest, with their events, matchers and commands.
• MCP servers: .mcp.json files and mcpServers in manifests. A server with a URL is remote; one with a command (often npx, uvx or Docker) starts a local process. Codex .app.json connectors are counted separately.
• Bundled code: files with code extensions (Python, shell, JavaScript, TypeScript, PowerShell and others), skipping node_modules and build folders. Each file is searched line by line for network call patterns, process spawning (subprocess, child_process, exec) and environment variables whose names look like keys, tokens or secrets.
• License: a LICENSE file in the folder, then the manifest, then SKILL.md frontmatter. If none states one, the repository's license may still apply.

The signals

• Pre-approved shell: Its allowed-tools (or tools) list includes a shell tool such as Bash, so the agent may run commands without asking each time.
• Hooks: Ships hooks that run automatically on agent events (for example before a tool call or at session start).
• Local MCP server: Starts an MCP server process on your machine (command, npx/uvx package or Docker image).
• Remote MCP server: Connects to a hosted MCP server URL, so tool calls and their data go to that service.
• Bundled scripts: Contains code files (Python, shell, JavaScript…) that the agent can run.
• Network calls in code: At least one bundled code file contains an HTTP or socket call pattern (requests, fetch, curl…).
• Reads credentials: Code or MCP config references an environment variable that looks like a key, token or secret.
• Spawns processes: Bundled code starts other programs (subprocess, child_process, os.system, exec…).

What it can't tell you

• It is not a security audit or a safety rating. A signal says something is there, not that it's bad: a GitHub plugin is supposed to call GitHub. Read the linked lines and decide yourself.
• Pattern matching misses things (obfuscated code, calls inside dependencies, downloaded code) and finds harmless ones (a URL in a test file). Every match is linked so you can check it.
• What pre-approved tools actually allow depends on your agent and its permission settings; some agents ignore allowed-tools.
• Instructions in SKILL.md can still ask the agent to do things; we don't interpret the prose.
• The scan reflects the commit shown. Skills change, so check the current files before installing.

Data

All results are at /api/permissions.json (CC BY 4.0) and summarised for AI assistants in /llms.txt. Scanned 2026-10-27. Found a wrong result? Use the bug report link in the footer.