How skills get in

1. The repository has at least 100 GitHub stars, is not a fork, is not archived, and was pushed to within the last year.
2. The skill has a valid SKILL.md: a name, a description and instructions long enough to do something.
3. A pattern scan finds nothing no skill should need: piping downloads to a shell, reading SSH or cloud keys, hidden characters, hiding things from the user, or skipping permissions.
4. Copies are removed. When several repositories carry the same skill, only the one with the most stars is listed.
5. Repositories that mostly gather other people's skills list at most 40.

What this does not prove: stars can be bought, a pattern scan can be evaded, and no skill here was run end to end. Every skill can instruct your agent, and “runs scripts” skills can run code on your machine. Read a skill before you install it.

The latest run

Repositories read

3,874

Repositories listed

1,567

Skills removed for a risk pattern

697

Copies removed

5,014

Skills listed

18,831