A skill is text injected straight into your agent's context, which makes it a prompt-injection surface, not just a convenience. Skill verification is the static security review that catches hostile or sloppy skills before they reach your agent: command shadowing, greedy triggers, injected instructions, and unsafe scripts, checked by an open-source script with published criteria and machine-readable results.
Plugins run code, so plugin security focuses on what code can do: hooks, tool scopes, subprocess calls. Skills are different. A SKILL.md never "executes", it is read into the model's context the moment the skill triggers. From that position it can try to do everything a prompt injection can do: override instructions, conceal actions from the user, redirect the agent's work, or steer the agent into running the scripts it shipped alongside. The skill ecosystem has exploded into the thousands across competing directories, and the directories racing to list the most skills check none of this. Verification with published criteria is the missing layer.
A skill named like a built-in command (or like another command in the same plugin) can intercept work the user meant for something else. Anthropic hardened Claude Code against exactly this attack. Verification rejects any skill whose name collides with a built-in Claude Code command or with a command shipped by its own plugin, and requires the spec-compliant lowercase-hyphen name matching its directory.
A skill description is its trigger: the agent reads it to decide when the skill applies. A description that claims everything ("use this skill on every request") gets injected into unrelated work, hijacking context it has no business in. Verification requires honestly-scoped triggers that describe a real, bounded job.
The body of a SKILL.md is injected directly into the agent’s context when it triggers. Verification screens every markdown file a skill ships for instruction-override language ("ignore previous instructions"), concealment ("do not tell the user"), guardrail bypasses, and instructions to exfiltrate data, while exempting documentation that teaches these attack patterns for defensive purposes.
Skills can ship helper scripts, and the agent may run them. Verification screens every executable file for piping remote content into a shell, decoding hidden payloads, destructive deletion, credential file access (SSH keys, AWS credentials), and sending environment variables or secrets to the network.
These four screens are the skill-safety check, one of the eight checks of the Sigistry verification methodology (v1.1). Skill structure (valid frontmatter, no broken references) is a separate check. Everything is static analysis: nothing is executed, every result names the exact file and reason, and the verifier is open source.
Before you publish a skill anywhere, it should pass all seven of these:
The free in-browser checker tests every item automatically against any public GitHub repository. When everything passes, submit your work and the Verified by Sigistry badge makes the result public, machine-readable, and re-checked by CI on every change.
Skill verification is a static security review of an AI agent skill (a SKILL.md file plus any scripts and references it ships) against published criteria: no command shadowing, honestly-scoped triggers, no prompt-injection or concealment language, and no unsafe scripts. Sigistry runs it with an open-source script and publishes machine-readable results, so a "verified" claim is backed by evidence anyone can re-run.
Because a skill is not sandboxed code, it is text injected directly into an AI agent’s context when the skill triggers. That makes skills a prompt-injection surface: a hostile skill can attempt to override the agent’s instructions, conceal actions from the user, trigger on every request to hijack unrelated work, or ship helper scripts that exfiltrate credentials. Skill ecosystems have grown into the thousands across directories that perform no vetting.
Three ways. Instantly: run the free in-browser checker against any public GitHub repository; the skill-safety check runs alongside seven other checks. Locally: run the open-source verifier (node scripts/verify-plugins.mjs path/to/plugin) from the Sigistry marketplace repository. Officially: submit to the registry, where CI re-runs every check on every change and your skill earns the Verified by Sigistry badge.
Command shadowing is naming a skill so it collides with a built-in command or another extension’s command, causing the agent to load the wrong thing when the user asks for the real one. It was a real enough attack that Anthropic hardened Claude Code against skills that shadow user commands. Verification rejects shadowing outright.
A skill description that claims relevance to everything ("always use this skill", "applies to every request"). Since the agent uses descriptions to decide which skills to load, a greedy trigger gets a skill injected into unrelated work, wasting context at best and hijacking behavior at worst. Verification requires descriptions that scope a real, bounded job.
Plugin validation focuses on what code can do: hook scripts that run on your machine, agent tool scopes, manifests. Skill validation focuses on what text can do once inside the agent’s context: shadowing, trigger scope, injected instructions, and the scripts a skill carries. Sigistry’s methodology covers both: eight checks total, of which two (skill structure and skill safety) are specific to skills.
Yes. The Sigistry plugin checker runs the full eight-check methodology, including skill safety, against any public GitHub repository, entirely in your browser. Nothing is uploaded and nothing is executed; it is the same open-source logic the registry runs in CI.