How we score

Every skill starts at 100. We subtract points for each kind of thing its files can do. Each kind counts once, however many times it appears.

What we look for

What the skill can do	Points off	If the author says so
Contains code that is hidden or hard to read	25 points	13 points
Reads your browser cookies or saved passwords	25 points	13 points
Reads your saved credentials, such as SSH keys or .env files	20 points	10 points
Downloads and installs other software	15 points	8 points
Changes files outside its own folder	10 points	5 points
Can call paid AI services billed to you	10 points	5 points
Sends data to these websites	5 points	3 points
Runs commands on your computer	5 points	3 points

If the skill's SKILL.md or README tells you about it, we take off half as many points. Honesty about a capability matters. Hiding it matters more.

We read the skill's own folder, its plugin's hooks, and the files its code or its own docs point to. We do not follow links onward from those docs, and we skip CI workflows and other skills' folders: they are not what you install.

We read code, not explanations: prose in Markdown files and comment lines in code never count. When one repository has the same skill in several folders, we list it once and show the lowest-scoring copy, with the others on its page.

Risk levels

Low risk score 80 to 100
Review before installing score 50 to 79
High risk score 0 to 49

Limits of static scanning

We read files. We never run the skill. A skill can look quiet and still behave differently when it runs.
We look for known patterns. A determined author can write code our rules do not recognise, so a high score is not a guarantee.
A flag means the skill can do something, not that it does anything wrong. Many useful skills need the internet or a terminal.
We scan one version of each skill. If its author changes it later, the score is out of date until the next scan.
If a file could not be read we say "Partially scanned", and the real score may be lower.