Methodology · engine v1.0.0-public

How a skill gets its grade.

A Skillspace rating is a formula over a skill's files. It is published here in full, down to the last penalty, so anyone holding the same files can arrive at the same number and tell us when we are wrong.

Inputs

Files on disk. Frontmatter, body, directory layout, and the text of every bundled file.

Method

Parsing and regular expressions. The same engine on the server and in the desktop app.

Never

Execution. No script runs, no install happens, no network call is made on the skill's behalf.

The atlas

Where the 139,726 skills come from.

Found. We scan GitHub for agent skills: SKILL.md packages for Claude Code, Codex, Cursor and other agents. The scan found 144,036.
Deduplicated. Skills are often copied between repositories. We merge copies and keep the one from the most-starred repository: 139,726 skills, with 4,310 duplicate pages redirecting to their canonical.
Classified. Each skill is placed in one of 276 categories, grouped into teams and departments like a company. Two independent models label nearly every skill; a few have only one model's label. A page says so when the two disagree.
Scored. The engine on this page grades every skill from its SKILL.md: architecture, maturity, and a security scan that can cap the grade.
Screened. The models that label and judge skills can also flag one for prompt injection, guardrail bypass, harmful content or credential exposure, or as an attack benchmark or a test fixture. In this snapshot they flagged 6 skills for prompt injection, 5 for guardrail bypass, 3 for harmful content, 1 for credential exposure, 102 as attack benchmarks and 200 as test fixtures. A flag overrides a passing safety scan: the skill's page names the flag instead of a pass, the skill is never launch-quality, and it is left out of our rankings and recommendations.
Judged. In crowded categories the strongest contenders are compared side by side by a judge model on six dimensions. 1,812 skills carry a judge review.
Tested. 56 skills also carry blind head-to-head results from real tasks, run against other skills in the same category (including a deliberately weak one) and a no-skill baseline; their pages say how many comparisons they won.

A skill is launch-quality when it is graded A to C with a clean safety verdict, and not excluded by a quality filter. The filters catch skills our model's safety screen flags for prompt injection, guardrail bypass, harmful content or credential exposure; test fixtures and attack benchmarks; skills written only for the repository they live in; templates and stubs; and near-duplicate variants and copies of other skills. Launch-quality skills get a full page: 27,503 of them. The rest get a short page that points to launch-quality skills in the same category, and the short page of a skill graded A to C whose safety scan passed says why it is not one. Every rating is a snapshot, taken in September 2026.

Browse the atlas by category →

The formula

Two numbers combine. One finding can overrule both.

Architecture and maturity make an intrinsic score. Security does not average into it. Security sets a ceiling, because a skill that shells out to a stranger is not made safe by being well written.

Step 1 · intrinsic quality

intrinsic = round( architecture × 0.55  +  maturity × 0.45 )

Step 2 · the security cap

overall = cap( intrinsic , worst security finding )
grade   = A ≥ 90   B ≥ 80   C ≥ 70   D ≥ 55   F below 55

Worst finding	Verdict	Effect on the score
critical	unsafe	Capped at 15. An unsafe skill cannot be adopted into an organisation at all.
high	risky	Capped at 45. It can still be installed by a person who reads the finding and decides.
medium	review	Capped at 72, which is a C at best.
low	ok	Four points off. The verdict stays ok.
none	ok	Unchanged.

The cap is a ceiling, not a subtraction. A skill with an intrinsic 60 and one high finding scores 45. A skill with an intrinsic 40 and the same finding still scores 40.

Dimension one

Architecture, weighted 55 percent of intrinsic.

Five sub-dimensions. Each starts at 100 and loses points against a fixed list. Every penalty is below. This is the part that predicts whether a skill fires when it should, and it is the part no other registry publishes.

01 25% of architecture

Triggerability

Whether the description will make the model reach for this skill at the right moment.

Penalties

No description at allscore 0
Description under 30 characters−40
Description over 1024 characters−20
No use when style trigger cue−25
Description written as an order rather than a third-person cue−10
Description summarises the workflow instead of naming the trigger−20

02 25% of architecture

Instruction quality

Whether the body is worth loading once the skill fires.

Penalties

Body under 200 characters−45
No markdown headings anywhere in the body−15
Placeholders left in: TODO, FIXME, TBD, lorem ipsum−30

03 20% of architecture

Modularity

Whether one skill is trying to be six.

Penalties

SKILL.md over 500 lines−30
SKILL.md over 800 linesa further −20
More than 14 top-level sections−15

04 15% of architecture

Progressive disclosure

Whether the bulk sits in files that load on demand instead of in the context window on every session.

Penalties

Over 500 lines−1 per 10 lines over 500, max −50
Over 250 lines with no references/ to offload into−25
References nested deeper than one level−15

05 15% of architecture

Structure and frontmatter

Whether the file is well formed enough for a harness to load it without guessing.

Penalties

Missing frontmatter name−45
name not lowercase-and-hyphens, or over 64 characters−20
Missing description−20
Broken relative links in the body−10 each, max −40

Sub-scores are clamped to the range 0 to 100 before weighting, so three penalties on one sub-dimension cannot drag the others down with them. Mean architecture across 396 skills: 97.

Dimension two

Maturity, weighted 45 percent of intrinsic.

Seven signals, each present or absent. The score is the share that pass. The level is a separate ladder that says which signals a skill has reached, not how many.

The seven signals

Complete frontmatter

A name and a description, both present.

100%

Non-trivial body

More than 200 characters of instruction after the frontmatter.

100%

References

A references/ directory, or links into one from the body.

71%

Scripts

At least one executable file that is not SKILL.md.

60%

Licence

A license field in the frontmatter, or a LICENSE file.

43%

Version

A version field in the frontmatter.

15%

Evals

An evals/ or tests/ directory, or a file with eval in its name.

The percentage is how many of the 396 skills in our public benchmark corpus carry that signal. Score = passed ÷ 7, as a percentage.

The L0 to L4 ladder

Level	Reached when
L0 Experimental	The body is thin or the frontmatter is incomplete. Nothing else is considered.
L1 Basic	Frontmatter and body are there. Nothing else is.
L2 Structured	There are references or scripts.
L3 Maintained	There is a licence, plus a version or references.
L4 Certified	There are evals, a licence, and a version.

L0 1

L1 90

L2 145

L3 156

L4 4

The ladder is checked from the top down, so a skill with evals but no licence lands at L2, not L4. That is deliberate. Evals you cannot legally reuse are not maturity.

Dimension three

The scanner never executes anything it scans.

It opens files and runs regular expressions over their text. No script is run. No installer is invoked. No network request is made on the skill's behalf. A skill cannot attack the thing that is rating it, and a rating cannot be the reason a payload fires.

That choice has a cost, and it is the honest one to state next: static reading catches what a file says, never what it does. A skill that fetches its real instructions at run time reads as clean. A skill that assembles a dangerous command out of three harmless strings reads as clean. Everything in the table below is a shape in the text, not an observed behaviour.

critical score capped at 15, verdict unsafe

destructive rm -rf on home/root 5

A delete rooted at ~, / or a variable.
fork bomb 0

The classic self-replicating shell function.
pipe remote script to shell 2

curl or wget piped into sh, bash or zsh.
reverse shell 0

An interactive shell redirected to /dev/tcp.

high score capped at 45, verdict risky

prompt-injection: ignore-previous 3

Text instructing a model to ignore prior instructions.
exfiltration language 14

The skill talks about exfiltrating something.
instructs to hide actions from user 0

Text telling the agent not to tell, inform or reveal to the user.
references sensitive credential env 17

Named credential variables such as AWS_SECRET or GITHUB_TOKEN.
accesses sensitive system files 4

~/.ssh, /etc/passwd or /etc/shadow.
executes shell/subprocess 24

os.system, subprocess, child_process, execSync, spawnSync.
dynamic code execution (eval/exec) 13

A call to eval or exec.
base64 decode (possible obfuscation) 2

base64 -d or atob, which is how hidden payloads usually travel.

medium score capped at 72, verdict review

reads environment variables 21

printenv or process.env.
suspicious outbound endpoint 0

A request whose URL contains webhook, paste, ngrok, or a Discord API path.
hidden/zero-width/bidi unicode chars 0

Characters that render as nothing but change what the model reads.

low 4 points off, verdict stays ok

over-broad allowed-tools ('*') 2

An allowed-tools frontmatter field with a wildcard in it.
mentions secrets in text 133

The words password, api key, or token appear anywhere in the files.

The number beside each rule is how many times it fired across the 396 skills in our public benchmark corpus. Findings are deduplicated per skill by severity and label, and at most twelve are kept. 149 skills had at least one finding of any kind; 66 had a finding severe enough to cap the score.

Dimension four

Capabilities are derived, not scored.

Nothing here moves the number. It is the answer to the question a security review actually asks, which is not how good the skill is but what it can reach.

Triggers

The cue lifted out of the description, plus any allowed-tools the frontmatter declares. If there is no cue, the entry says so.

Data accessed

Environment variables, named credential variables, bundled reference files, local file reads and writes, sensitive system paths.

Network

Every host named in any file, with localhost and example domains dropped. Up to eight are listed. A skill with none is marked local-only.

Setup needed

Dependency installs, credential variables it expects you to have, command line tools it calls, and whether it documents its own requirements.

64% of the corpus we scored names no outbound host at all. A host appearing in a capability list is a host mentioned in the files. It is not proof the skill will call it, and its absence is not proof the skill will not.

The letter

Five boundaries, taken after the cap.

Grade	Score	Reads as
A	90 and up	Ship it.
B	80 to 89	Solid.
C	70 to 79	Works, needs polish.
D	55 to 69	Rewrite candidate.
F	under 55	Do not ship.

The distribution across 396 benchmark skills

A 29

B 146

C 80

D 89

F 52

Mean 73, median 77. Most of the corpus sits in the D band, and the reason is almost always maturity rather than architecture: the writing is fine, the licence and the version and the evals are missing.

Browse every rated skill by category →

Limits

What the rating does not measure.

A number that only advertises its strengths is a marketing asset, not a measurement. These are the three places a Skillspace grade will let you down, stated before you find them yourself.

Limit 01

It cannot tell you the skill works.

Nothing in the engine measures whether a skill improves the output of an agent that loads it. A well-formed skill with confident, wrong instructions scores an A. Effect has to be measured against a task, on a model, with a control. That is a benchmark, and it is a different piece of work.

Limit 02

It is static, so runtime behaviour is invisible.

The scanner reads the files as they sit on disk. It cannot see a skill that downloads its real instructions on first run, a script whose dangerous argument is assembled from fragments, or an MCP server the skill points at whose behaviour changes next week. A clean security verdict means nothing matched, not that nothing is there.

Limit 03

Regex security has both kinds of error.

False positives: a skill that teaches you to avoid curl | sh matches the same rule as one that runs it. The mentions secrets in text rule alone fired on 133 of 396 skills, most of them harmless. False negatives: any pattern we have not written a rule for scores as clean.

This is why the footer of every page says the same thing. A Skillspace rating is an automated static assessment. It is a strong signal and a good first filter. It is not a certification, and it is not a substitute for reading a skill before you run it.

Disputes

If we got your skill wrong, here is how it gets fixed.

Four routes, ordered by how many disputes each one actually settles. Most end at the first, without anybody writing an email.

Change the files.

The score is a pure function of the files. Add the licence, add the version, shorten the body, put a real trigger cue in the description, and the grade moves with them. The atlas is a snapshot, not a live feed: this one was taken in September 2026, and a change you push counts from the next one we publish. Nothing needs to be appealed to make a real improvement count.

Report a rule that misfired.

If a finding is a false positive, the fault is in the rule, not in your skill. Send the skill and the finding. We fix the rule, and the next snapshot re-scores every skill in the atlas against it, not just yours. A rule that produces more noise than signal gets narrowed or dropped, and the change is noted on this page.

Claim the page.

Every skill has a page on this site. If you wrote the skill, you will be able to claim yours: your name on it, and a right of reply that renders next to the score rather than underneath it. Claiming will not change the number and will not remove a finding. It puts the author in the conversation. Claiming is not live yet, so until it is, the email below reaches the same people.

Argue with the weights.

The weights on this page are a judgement about what makes a skill good, and judgements can be wrong. If you think progressive disclosure is worth more than 15 percent, or that a missing licence should not cost what it costs, say so with the reasoning. Weight changes are published with a date and applied to every skill in the next snapshot, so every grade moves at once.

What we will not do

Change a score on request. A grade only moves when the files change or the rule changes. There is no rate card, no review tier, and no way to pay for a better letter. That is the only thing making the grades worth reading.

Dispute a rating Find your skill's page Include the skill, the finding, and what you think the engine misread.

Engine

worker/src/scoring/engine.ts, mirrored by desktop-app/src/main/scoring-engine.ts. The server and your laptop compute the same number from the same bytes.

This page's figures

Counted at build time from a scan of 396 real installed skills, scanner v1.0.0-public. Generated 2026-09-02.

Changes

A change to the engine is a change to this page in the same commit. If the two ever disagree, this page is the bug and we want to hear about it.