What do I need to use Skill Vetting?

The skill's contents; The provenance; The install context.

Is Skill Vetting free to use?

Yes — run it free in the browser playground (no API key needed for the sponsored trial, or bring any provider key), or install it into Claude Code, Cursor, ChatGPT and more via npx pm-claude-skills. MIT-licensed and open source.

Skill Vetting

Q: How do I know the Skill Vetting output is good?

The skill verifies itself against its own quality checks: Every file in the skill folder was read, not just SKILL.md; Every finding quotes its line — no vibes-based flags; The network list names every destination or says "none"; Prose instructions were audited as executable, not skimmed as docs.

🔵 Stable🕐 updated 2026-07-18 🔷 SkillSpec L3 pm-security

Vet an agent skill before installing it — read the SKILL.md and any scripts for the red-flag patterns (credential access, obfuscation, exfiltration, prompt injection), audit its blast radius, and produce a risk-tiered verdict. Use when asked is this skill safe to install, vet this SKILL.md, review this skill from a marketplace, or check what this skill can do to my machine. Produces the risk classification with quoted evidence, the permission-surface audit, the red-flag checklist results, and an install/sandbox/reject recommendation.

▶ Run it free — no key needed 📝 Grade your existing draft View SKILL.md ↗

What to give it

▸The skill's contents — SKILL.md plus *everything else in the folder* (scripts, references, hooks); a skill vetted by its README alone is not vetted

▸The provenance — source (official repo, known author, unknown upload), stars/downloads if visible, last-update date; reputation is a signal, not a verdict — popular skills have carried surprises

▸The install context — what the agent it's joining can already do (its permissions are the skill's permissions), and how sensitive the machine is

✅ The bar it holds itself to

Every skill in this library self-verifies — these are this skill's own quality checks, straight from its definition.

✓Every file in the skill folder was read, not just SKILL.md

✓Every finding quotes its line — no vibes-based flags

✓The network list names every destination or says "none"

✓Prose instructions were audited as executable, not skimmed as docs

✓Above-LOW verdicts route the final call to the human explicitly

⚠️ What it refuses to do

Do not vet by reputation alone — stars are a signal; the sweep is the vetting

Do not flag without quoting — unlocated suspicion is noise that erodes trust in real findings

Do not auto-clear skills with zero scripts — the prose layer is an attack surface too

Do not condemn explained power — a deploy skill runs deploys; scope-mismatch is the flag, not capability

Do not make the install decision for high-risk cases — evidence and a recommendation, human decides

Install

npx pm-claude-skills add --agent claude   # or codex · cursor · gemini · hermes
# or one-line MCP (every skill, any client):
claude mcp add pm-skills -- npx -y pm-claude-skills-mcp

Related skills

🔌 Embed this skill

Drop this on your blog, docs, or site — it renders a "Run this skill" card:

<div data-pm-skill="skill-vetting"></div>
<script src="https://mohitagw15856.github.io/pm-claude-skills/embed.js" async></script>

💬 Discussion

Skill Vetting is one of 750 open-source professional AI agent skills — all SkillSpec L3. Try them all in the browser · ⭐ Star on GitHub · Browse the full catalog