Your AI agent obeys any skill you install. I built an auditor to check them first

You would not run a random shell script from the internet as your own user, with your SSH keys and cloud credentials within reach. Yet that is roughly what happens when you install an agent skill without reading it.

a SKILL.md file your agent will obey, and optional scripts your agent will run with your permissions.

That makes a skill software, and it deserves the same suspicion you give any dependency. So I built Skill Auditor: an open-source skill (plus a dependency-free Python scanner) that reviews other skills and MCP server configurations before you install them, and gives you a verdict backed by evidence.

A skill is software. Skill Auditor reviews it before you give it access to your files, your keys and your terminal

A skill is a SKILL.md your agent will obey, plus scripts it will run with your permissions and your credentials. The ecosystem is huge (an August 2026 census counted about 58,700 skills among nearly 80,000 listings including MCP servers and plugins) and curation is thin: installing a skill without reading it is the same as running a script you downloaded from the internet.

Skill Auditor is a skill that reviews other skills (and MCP server configurations) before you install them, and gives you a verdict backed by evidence: what it found, in which file and line, and what to do about it.