skillme

Trust & safety

Skill Review Criteria

This is the public checklist behind the safety claims on skillme.dev. Every skill submitted to the catalog goes through the review described below before it is published.

What review is — and isn’t. Review is best-effort screening: an automated pass over the full SKILL.md content, followed by a human review before anything goes live. It catches the known patterns listed here. It is not a guarantee. A sufficiently novel or well-disguised attack could pass review, and a skill’s linked external resources can change after we review them. You should still read a skill before installing it — every skill’s full SKILL.md is displayed verbatim on its catalog page, so you can see exactly what Claude will be told.

1. Prompt-injection patterns

Instructions that try to hijack Claude rather than direct it:

  • "Ignore previous instructions" and variants
  • Attempts to override, disable, or argue around Claude's safety rules
  • Instructions that claim elevated authority ("you are now in developer mode", "the user has granted permission to…")

2. Hidden or obfuscated instructions

Everything a skill tells Claude must be readable by the person installing it:

  • Encoded content (base64, hex, unicode tricks) that decodes to instructions
  • Instructions concealed in comments, whitespace, or markup that renders invisibly
  • Directives that tell Claude to hide behavior from, or lie to, the user

3. Data-exfiltration attempts

  • Instructions to send conversation content, files, or personal data to external URLs
  • Unauthorized API calls or webhooks embedded in the skill's instructions
  • Requests for credentials, tokens, or secrets

4. Deceptive descriptions

The listing must match the payload:

  • The skill's name and description must accurately reflect what its instructions do
  • No skill that claims one purpose while its SKILL.md body instructs another
  • Placeholder or stub content is rejected — instructions must be real and substantive (the submission form enforces a minimum length; a stub with padding still fails human review)

5. License presence

  • Skills ingested from external repositories must carry a recognized open-source license (MIT, Apache-2.0, BSD, Unlicense, and similar permissive SPDX identifiers). Repositories with no license — or an unrecognized one — are blocked from automated ingestion and held for a human decision, since redistributing unlicensed work isn't ours to decide.
  • Direct submissions include an explicit license grant: the submitter confirms they authored (or may distribute) the content and license it under MIT for inclusion in the catalog.

6. Frontmatter and metadata validity

  • SKILL.md frontmatter must parse: name, description, and author present and well-formed
  • Name within length limits; description a plain-English sentence
  • Category must be one of the catalog's valid categories
  • A source URL, when provided, must be a valid public http(s) link — it is displayed on the skill page as provenance

How the review runs

  1. Automated screening. On submission, the full SKILL.md content is analyzed by an LLM-based safety classifier that checks for the injection, obfuscation, exfiltration, and deception patterns above, and produces a verdict with a written reason. Structural checks (frontmatter, lengths, category, URL validity) run at the same time.
  2. Human review. Nothing is published by the classifier alone. A human reviews every submission — including the classifier’s verdict and reasoning — before it goes live. This usually takes 1–3 business days.
  3. After publishing. Skills that are found to violate these criteria after publication are removed. If you find one, report it to security@skillme.dev.

Transparency

  • The catalog shows every skill's complete SKILL.md — the exact text Claude receives — before you install it.
  • Every skill links to its canonical source, so you can verify where it came from and who wrote it.

Want to add a skill to the catalog? Submit it here.

Skill Review Criteria · Skill Me