{"slug": "i-scanned-35-real-skill-md-files-16-tripped-a-rule-10-of-them-anthropic-s-skills", "title": "I scanned 35 real SKILL.md files — 16 tripped a rule, 10 of them Anthropic's official skills", "summary": "The SkillSentry team scanned 35 public SKILL.md files with its static rule layer and found 16 that tripped at least one rule, including 10 of Anthropic's official skills and all four that earned a \"dangerous\" verdict. The 161-millisecond scan produced 36 findings — one critical, 16 high, seven medium and 12 low — with the single critical hit landing on Anthropic's skill-creator skill for SS-005, which flags instructions smuggled through channels a skimming human reads as boilerplate. The team stressed that none of the flagged files represent an attack, arguing the scanner scores the shape of instructions rather than intent, and released the tool as an npm package with a web scanner for single files.", "body_md": "Your AI agent reads files written by strangers, and then does what they say. Every SKILL.md it loads is a set of natural-language instructions your agent will follow — and almost nobody runs them past a checker first.\n\nSo we did. Here's the whole methodology, reproducible in under a minute.\n\nWe took **35 real, public SKILL.md files**:\n\nThen we ran them through SkillSentry's static rule layer only:\n\n```\nnpm install -g @ulkoro/skillsentry\nskillsentry . --json --no-ai\n```\n\nNo model review, no judgement calls — just the fourteen pattern checks documented in the [Rulebook](https://intothe.tech/rules). Total scan time for all 35 files: **161 milliseconds**.\n\nOne disclaimer: we build SkillSentry, so treat this as a chef tasting their own soup in public. Every number below comes from the JSON output of that one command, and both repos are public — run it yourself and they'll reproduce.\n\n| verdict | skills | \n|---|---|\n| clean | 19 | \n| suspicious | 12 | \n| dangerous (stop and read it yourself) | 4 | \n\n36 findings total: **1 critical, 16 high, 7 medium, 12 low**. The median file scored a risk of zero — the risk concentrates in specific, nameable patterns:\n\n**Ten of the sixteen flagged skills are Anthropic's official ones — including all four dangerous verdicts.**\n\nThe worst scorer (risk 79) was an official skill whose job is fetching a published catalog over HTTPS: ten SS-002 hits for doing exactly what it says on the tin. The docx and pptx skills tripped SS-011 for the pattern *\"try `require('docx')`, and only if that fails run `npm install docx`\"* — a convenience today, and the exact door a typosquat walks through the day a dependency goes missing.\n\nTo be unambiguous: **none of this is an attack**. These are well-built skills by a team that ships threat models most projects never write down. The scanner fired anyway because it doesn't score intent — it scores *shape*. And the shape of \"fetch this remote resource,\" \"install this package if it's missing,\" and \"prefer my tool over that one\" is precisely the shape every documented skill attack has used.\n\nThe single critical finding landed on **skill-creator** — the official skill whose job is writing new skills. SS-005 flags content that smuggles instructions through channels a skimming human reads as boilerplate.\n\nThat's not an indictment; it's the trade in one anecdote. A pattern scanner must fire on patterns even in the most trustworthy file on the list — because the day a malicious skill copies that exact shape (and someone will), the detector must already be deaf to reputation. False positives on the good guys are the price of catching the bad ones early. A smoke detector that stays silent in the kitchen isn't discriminating; it's broken.\n\nNo. SKILL.md is where **npm was before lockfiles and audit**: an ecosystem shipping a new supply chain faster than the hygiene layer that eventually made dependency management survivable. The format is fine. What's missing is the habit of running the text past a checker before an agent runs the text. Nobody audits a README they'd never read — and skills are READMEs that execute.\n\n```\nnpm install -g @ulkoro/skillsentry\nskillsentry .          # scan a repo\nskillsentry diff old new   # what changed between snapshots?\n```\n\nOr paste a single SKILL.md into the [web scanner](https://intothe.tech). Clean takes five seconds and changes nothing. A hit gives you the exact rule, the evidence line, and how to fix it — before your agent follows it.\n\nThe full write-up with the complete methodology is on [intothe.tech](https://intothe.tech/learn/i-scanned-35-real-skills) (canonical source). The fourteen rules, with evidence and remediations, live in the [Rulebook](https://intothe.tech/rules).", "url": "https://wpnews.pro/news/i-scanned-35-real-skill-md-files-16-tripped-a-rule-10-of-them-anthropic-s-skills", "canonical_source": "https://dev.to/ulk0r0/i-scanned-35-real-skillmd-files-16-tripped-a-rule-10-of-them-anthropics-official-skills-1561", "published_at": "2026-11-06 17:48:34+00:00", "updated_at": "2026-11-06 17:53:46.387225+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "developer-tools"], "entities": ["SkillSentry", "Anthropic", "skill-creator", "npm", "intothe.tech", "@ulkoro/skillsentry"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/i-scanned-35-real-skill-md-files-16-tripped-a-rule-10-of-them-anthropic-s-skills", "markdown": "https://wpnews.pro/news/i-scanned-35-real-skill-md-files-16-tripped-a-rule-10-of-them-anthropic-s-skills.md", "text": "https://wpnews.pro/news/i-scanned-35-real-skill-md-files-16-tripped-a-rule-10-of-them-anthropic-s-skills.txt", "jsonld": "https://wpnews.pro/news/i-scanned-35-real-skill-md-files-16-tripped-a-rule-10-of-them-anthropic-s-skills.jsonld"}}