Agent skills you can check before you install.
Every skill shows its source, its security scan and, when one exists, its evaluation.
npx vskill@latest install openclaw/openclaw/diagnose-gatewayWorks with 56 install targets, including Claude Code, Codex and Cursor (vskill 1.2.16, counted 30 Oct 2026).
openclaw/openclaw/diagnose-gatewayFrom the registry- SourceNot confirmedFrom
github.com/openclaw/openclaw - Security scanPassedStatic scan score 96 of 100. Scanned, trust tier 2
- EvaluationNot run yetNo graded comparison recorded for this skill yet
How a skill earns its tier
Each check answers a different question. A skill climbs only as far as its checks allow, and its page shows the result of every one, so you can decide for yourself.
- ScannedTrust tier 2
- VerifiedTrust tier 3
- CertifiedTrust tier 4
Each tier also needs a minimum trust score, built from the scan, the model review, provenance and track record. Trust tier 1 means not scanned yet or below the bar, and trust tier 0 means blocked. Skills from the organizations we list as vendors skip the scan and are certified on publication.
Source check
We confirm that the person who submitted the skill owns or collaborates on its GitHub repository, check the skill and its author against the blocklist, and record a hash of the exact content we scanned, so a changed file is caught before it is published.
Repository confirmed
Security scan
Earns ScannedA static scan checks 57 patterns in 9 categories, including command injection, credential theft, data exfiltration and prompt injection. Each finding lowers a score that starts at 100, and 70 or above is a pass.
Scan passed
Model review
Earns VerifiedA model reads the skill for intent and scope and confirms or dismisses each critical finding from the scan. A pass, or a pass with concerns noted, lifts the skill to Verified.
Review passed
Human review
Earns CertifiedA person reviews the skill. With a confirmed source, a model review score of 80 or more and a trust score of 80 or more, it reaches Certified. Skills from vendor organizations skip the scan and both reviews and are certified on publication.
Review completed
Evaluation
An evaluation sits beside the tier, not on it. Where one has run, the same tasks are graded with and without the skill, and the page shows the registry verdict: effective, marginal, ineffective or degrading. Skill Studio computes its own verdict on your machine, with a fifth level, Emerging. A skill that has not been evaluated says so.
Find a skill for the job in front of you
Search by task, open the evidence, then install into your agent. Popularity is not a quality score.
Browse Claude Code skills by category
Install it the same way in every agent
vskill 1.2.16 installs into 56 install targets, and its repository carries 10 plugins with 22 skills (counted from the published release, 30 Oct 2026). Run it with npx vskill@latest, or install it with npm i -g vskill.
The same skills plug into the rest of the work: SpecWeave plans the tasks that use them, and SpecWithCode runs the agents that load them on your own machines.
vskill find <query>- Search the registry from your terminal.
vskill install <owner/repo/skill>- Run the security scan, then install into your agents. Add --agent to pick one.
vskill update --global- Update the skills you installed for your user, recorded in ~/.agents/vskill.lock.
vskill pin <skill>- Hold a skill at its current version until you unpin it.
vskill doctor- Find duplicate, divergent and broken skill folders across your agents.
Test whether a skill helps before you rely on it
Skill Studio runs on your machine. Write what good looks like, run the same tasks with and without the skill, and compare versions side by side.
npx vskill@latest studio- Define the outcomeUse realistic tasks and clear pass conditions, including when the skill should stay out of the way.
- Compare like with likeHold the task and environment steady. Model, effort, tools and harness all change the result.
- Read the evidenceInspect outputs, failures and usage. Model requests go to the provider you select.
Since vskill 1.2.9 (17 Oct 2026), Studio can publish a skill privately, so only your team can install it. See plans for private skills
Do stronger models still need skills?
Sometimes. A precise deployment procedure, organization-specific convention, or reusable script can add real value. Generic advice an agent already follows can add noise. Install for a concrete need, then test whether the skill helps.
Does verified mean safe or better?
No. Verification describes the checks run on a particular version. It does not guarantee safety, correctness, or a quality improvement. Read the scan findings and evaluate the skill on your own tasks.
Can I use this with Codex or Claude Code?
Yes. vskill installs into Codex, Claude Code, Cursor and other agents. Not every agent runs every skill the same way, so check the skill’s prerequisites and your agent’s capabilities.
What stays on my machine?
Skill Studio runs a local workspace. If you choose a cloud model, evaluation prompts and relevant inputs go to that provider. Publishing sends the skill to its destination. See parameters and secrets before connecting a workflow.