Every night SkillCheck pulls skills (SKILL.md folders) from public GitHub repos and servers from the official MCP Registry, then runs automated static checks. No code is executed.
We start at 50 and subtract when files contain patterns showing the item can: run shell commands (−10), make network calls (−6), write or delete files (−6), read environment variables or credentials (−6), download and run code or install packages at runtime (−12), or contain encoded/eval'd content that is hard to review (−12). Mentions in instructions only count half; patterns in bundled scripts count fully. For MCP servers: hosted remote (−6), runs locally as a package (−4), asks for API keys (−4), plus a capped (−30) shallow scan of the source when a public GitHub repo exists. Tests, examples and docs folders are excluded; install commands in docs are noted but not penalised.
These are capabilities, not verdicts. Many excellent tools need shell or network access to work. A lower capability score means "review more carefully", not "malicious".
Recency of last update (up to 15), GitHub stars (up to 10), contributors (up to 5), declared license (5). Archived repos get 0.
Meaningful description (8) and a public source link (7).
Pattern matching has false positives and negatives. It is not a security audit. Maintainers can request corrections.