Agent Skills · Learn · The open SKILL.md standard
Security

Are agent skills safe?

A skill is just markdown — but markdown that instructs your agent, and that can ship helper scripts the agent may run. Treat a SKILL.md like any third-party code: useful, and worth a 60-second read before you trust it.

What's actually in a skill

A skill folder holds a SKILL.md (instructions) and, optionally, scripts/ and references/. Two things to be aware of:

This isn't unique to skills — it's the same trust model as any package, extension, or snippet you add to a project. The point is simply to look before you install.

The 60-second vet

  1. Read the SKILL.md body. Does it do what it claims, and only that? Be wary of instructions to fetch and run remote code, send data to an unfamiliar URL, or touch files outside the task.
  2. Check the scripts. Open anything in scripts/. Short, readable, scoped to the task is good. Obfuscated or network-heavy is a flag.
  3. Check the source + author. Every skill on GuildSkills links its source repository and shows author + license where available. Prefer skills you can trace to a real repo with history.
  4. Prefer narrow permissions. Some agents honor an allowed-tools frontmatter field — a skill that restricts itself is a good sign.

Install with a safety margin

Run a new skill in a project where a mistake is cheap (a scratch repo, a branch, a container) before using it on anything important. Most agents ask before running commands — keep that confirmation on while you're getting to know a skill. Review the diff a skill-driven change produces, just as you would a pull request.

How GuildSkills helps

We don't execute or modify skills — we index them and link the original source so you can verify exactly what you're installing. The Pro Quality Score factors in signals like documentation completeness and attribution, which correlate with well-maintained, trustworthy skills. But the final check is always yours: read it, then install it. See the install guide for the safe two-step on each agent.

Frequently asked

Are agent skills safe? — answered

Can an agent skill run code on my machine?
A skill can bundle scripts and instruct your agent to run commands, which execute with your agent's permissions. Read the SKILL.md body and any bundled scripts before installing, and keep your agent's command-confirmation prompts on.
How do I check if a skill is safe before installing?
Read the SKILL.md body (does it do only what it claims?), open any bundled scripts, and check the source repository and author. GuildSkills links the original source for every skill so you can verify it.
Is it safe to use the same skill across multiple agents?
The skill content is identical regardless of agent, so the same vetting applies once. What differs is where you install it (skills dir vs rules file) — the install guide covers each, but the safety review is the same.