Free tool for Claude, Codex and other agent skills

Check a skill before you install it

Paste a GitHub link to an AI agent skill. We read every file, scan it with NVIDIA's SkillSpector and our own checks, and tell you what it would do on your machine. Nothing in the skill ever runs.

Link to a skill

A repository, a folder inside one, an owner/repo@skill name from skills.sh, or a whole npx skills add command.

Which link do I paste?

Open the skill on GitHub.
Click into its folder: the one with a SKILL.md file in it.
Copy the address from your browser's address bar and paste it here.

For example github.com/NousResearch/hermes-agent/tree/main/skills/apple/apple-notes checks one skill. A folder of skills such as …/skills/apple checks all of them, up to 25. For a bigger folder or a whole repository, we list the skills inside and you pick. A link to any file works too: we check the folder it's in.

Upload a .zip or SKILL.md Up to 20 MB. Deleted as soon as it's checked.

Try

What we look for

Tells Claude not to ask you

Instructions to skip permission checks, never wait for your go-ahead, or start agents with every prompt turned off.

Runs code from the internet

Install scripts piped straight into a shell, and packages that don't exist yet, which anyone could publish tomorrow.

Hides what it says

Invisible characters and HTML comments that Claude reads but you won't see in a preview.

Goes after your secrets

Scripts that read SSH keys, cloud credentials, password stores or browser data.

Sends your data somewhere

Every address its scripts contact, and services that would hold access to your accounts.

Gives itself permissions

Tools a skill pre-approves, so Claude can use them without asking while it's active.

When we checked 1,582 skills by hand, SkillSpector's own "do not install" label was wrong almost every time, and it rated one of the three real problems as only "caution". So reports lead with the checks above and show the scanner's findings as detail. How it works.