About

Imported from aiskillstore/marketplace (skills/tatelyman/agent-skill-trust-check/SKILL.md). Install upstream with npx skills add aiskillstore/marketplace --skill agent-skill-trust-check. Copyright stays with the author (MIT).

Agent Skill Trust Check

Name: agent-skill-trust-check
Author: aiskillstore

Use this skill before installing a third-party agent skill, SKILL.md package, MCP-linked skill, or marketplace listing.

What This Skill Does

Reads a public or local skill description before install.
Flags patterns that deserve review: shell execution, destructive commands, secrets, wallet/payment actions, network output, persistence, and prompt-boundary issues.
Separates basic provenance signals from risky behavior signals.
Produces a patch order that a maintainer can resolve before the skill is trusted.

When To Use

Use this when an agent is about to install or recommend a skill from:

OpenClaw, Hermes, or ClawHub-style marketplaces.
Claude Code, Codex, Cursor, Windsurf, or Gemini skill directories.
MCP-linked skill bundles.
GitHub repositories that include a SKILL.md, tool manifest, or install script.

Run From The Public Repo

git clone https://github.com/TateLyman/agent-skill-trust-check.git
cd agent-skill-trust-check
npm run check
node bin/agent-skill-trust-check.js ./SKILL.md

Marketplace-safe stdin mode:

node bin/agent-skill-trust-check-stdin.js < ./SKILL.md

For JSON output:

node bin/agent-skill-trust-check.js ./SKILL.md --json

npm command:

npx --yes agent-skill-trust-check ./SKILL.md --json

Review Rules

Before installation, check:

Does the skill run shell commands, package installers, or process-spawn APIs?
Does it read secrets, environment variables, wallet data, credentials, cookies, or private keys?
Does it send content to remote URLs or webhooks?
Does it create persistent background jobs?
Does it ask the agent to ignore or override higher-priority instructions?
Does it document source, license, version, tests, permissions, and uninstall steps?

Boundaries

This is a static pre-install check. The marketplace-safe runner reads only stdin and returns JSON. The local CLI can also read a local path or a public GitHub/raw/Gist URL when run from the repository checkout. Neither mode executes the target skill or proves the runtime is safe.

For marketplace-grade review, use the paid Agent Skill Trust Check listing:

https://orkai.ai/skills/agent-skill-trust-check

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/aiskillstore-marketplace-agent-skill-trust-check/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

aiskillstore-marketplace-agent-skill-trust-check.ocm.jsonjson

{
  "ocm": "1",
  "id": "aiskillstore-marketplace-agent-skill-trust-check",
  "kind": "skill",
  "name": "agent-skill-trust-check",
  "description": "Static pre-install trust review for SKILL.md, OpenClaw, Hermes, MCP, and agent-skill marketplace packages before they request local, account, payment, or external access.",
  "publisher": "aiskillstore",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "security",
      "agent-skills",
      "skill-review",
      "mcp",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Static pre-install trust review for SKILL.md, OpenClaw, Hermes, MCP, and agent-skill marketplace packages before they request local, account, payment, or external access."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/aiskillstore/marketplace",
      "path": "skills/tatelyman/agent-skill-trust-check/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/aiskillstore/marketplace/blob/HEAD/skills/tatelyman/agent-skill-trust-check/SKILL.md",
      "key": "aiskillstore/marketplace/skills/tatelyman/agent-skill-trust-check/SKILL.md"
    },
    "license": "MIT"
  },
  "instructions": "# Agent Skill Trust Check\n\nUse this skill before installing a third-party agent skill, SKILL.md package, MCP-linked skill, or marketplace listing.\n\n## What This Skill Does\n\n- Reads a public or local skill description before install.\n- Flags patterns that deserve review: shell execution, destructive commands, secrets, wallet/payment actions, network output, persistence, and prompt-boundary issues.\n- Separates basic provenance signals from risky behavior signals.\n- Produces a patch order that a maintainer can resolve before the skill is trusted.\n\n## When To Use\n\nUse this when an agent is about t",
  "cost": {
    "context_tokens": 558
  }
}

Fetch it by URL: GET /api/v1/registry/aiskillstore-marketplace-agent-skill-trust-check/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.