Free skill review tool

Know a skill
before your agents use it

Score instruction quality and scan for risky behavior. Content is inspected as text and is never executed or installed.

  • Never executed
  • Five-part quality rubric
  • NVIDIA SkillSpector scan
01

Your skill

What are we reviewing?

12 local risk rules · quality rubric · nothing is installed

Why every skill needs a second look

Free agent skill review: a five-part quality rubric plus an NVIDIA SkillSpector security scan, on content that is read as text and never executed.

Why it matters

An agent skill is a folder of instructions, a SKILL.md and whatever it references, that a coding agent loads and then follows. That last word is the risk. Instructions can tell an agent to read files, reach the network, run commands, or go looking for credentials, and an agent that trusts the folder will do it. Reading one before it reaches your agents is the whole point of this tool.

Paste the contents, point at a public HTTPS URL or a GitHub repository, or upload a SKILL.md or a ZIP bundle up to 2 MB. Everything is inspected as text. Nothing is installed, nothing is extracted into a workspace, and nothing is executed.

What the tool does

Two scores come back. Quality is a five-part rubric: skill specificity out of 25, documentation out of 25, installability out of 20, workflow completeness out of 20, and practical usefulness out of 10. Security is NVIDIA SkillSpector's static scan, reported with findings, line numbers, severity, and the permissions the instructions imply. The overall score weights quality at 55 percent and security at 45.

Every review is keyed to a SHA-256 fingerprint of the exact content reviewed. The same bytes always return the same review, get a permanent shareable result page, and get an SVG badge you can drop into a README. Change one line of the skill and the fingerprint changes with it, so a badge can never quietly describe an older version.

92
github-pr-reviewer.skill
Rubric score: 92/100 · Safety Grade: A · Production Ready
✓ Verified Skill
Example shareable Skill Evaluation Badge output with rubric score and safety grade.

Terms worth knowing

Agent skill
A folder of instructions an agent loads and follows, usually a SKILL.md plus supporting files, scripts, or references.
SKILL.md
The entry file. Frontmatter names the skill and describes when it should trigger; the body carries the instructions themselves.
Quality rubric
Five weighted criteria: specificity (25), documentation (25), installability (20), workflow completeness (20), practical usefulness (10).
SkillSpector
NVIDIA's static analyzer for agent skills. It reads instructions for known risky patterns and reports each hit with a line reference.
Implied permissions
What the instructions ask an agent to reach for: the filesystem, the network, command execution, or stored credentials.
Content fingerprint
A SHA-256 hash of the reviewed content. It makes a review reproducible and ties a shared result or badge to exact bytes.

Frequently asked questions

Short answers for the decisions that usually come up after a first run.

Is the skill installed or executed?

No. Content is read as text and analyzed statically. Nothing is installed into a workspace, no ZIP is extracted to disk, and no instruction inside the skill is carried out.

What do the scores mean?

Quality lands in one of four tiers: 85 and above is Excellent, 70 is Strong, 55 is Promising, below that is Needs review. Security is scored separately from the SkillSpector scan. The overall figure is quality at 55 percent and security at 45.

Does a clean security scan mean the skill is safe?

No, and the tool says so on the result. Static analysis finds known patterns in text. It cannot reason about intent, follow a linked script, or tell you what a skill does at runtime. Treat a clean scan as one signal, and still sandbox anything you did not write.

What can I submit?

Three inputs. Paste SKILL.md contents directly, give a public HTTPS URL or a GitHub repository, or upload a SKILL.md or ZIP bundle up to 2 MB.

What is the badge for?

Every completed review gets an SVG badge tied to its content fingerprint, plus a permanent result page. Put the badge in a README and readers can open the full review, scores, findings, and the exact lines behind each one, without running anything themselves.

Why does the same skill return an identical review?

Reviews are cached against the SHA-256 fingerprint of their content. Identical bytes return the identical review, which is what makes a shared result trustworthy. Change a single character and it is a new fingerprint and a fresh review.

Can I evaluate a whole repository of skills?

Point it at the GitHub repository URL. It reads the skill files it finds there over public HTTPS. Private repositories are not fetched, so paste or upload those instead.