Check S2 · provenance family · severity HIGH · automatic · one of the 15 skill and plugin checks
The question this check asks: how old is this listing, and how old is the account behind it? A skill on skills.sh is a directory in a GitHub repository with a created_at and an owner with one of their own; a Claude Code plugin resolves to a repository the same way. Two dates, read once, compared to two thresholds. It is the cheapest check in the roster and the one the February 2026 operators would have tripped on every listing.
The ClawHavoc campaign on ClawHub was days old on every count. OpenSourceMalware's write-up of 1 February 2026 counts 28 skills published between 27 and 29 January and a second group of 386 between 31 January and 2 February; Antiy CERT's post of 6 February attributes the campaign to 12 author IDs. Snyk's 4 February advisory records the clawhub skill at 7,743 downloads before the marketplace removed it on 3 February. The accounts were created for the operation and the listings published within days of them — the shape a repository's owner-account-age and repository-age checks were written for, and the reason this roster reads the same two dates on a skill. The malicious skills page has the record and the measurement.
The other half of the question is what a young listing does not mean. Every vendor's first plugin is a repository created that month; every developer's first skill sits on whatever account they have. The first measurement made that concrete: six official-marketplace plugins carried the age finding as high on the first run, each a repository created within 30 days by a vendor whose GitHub account was years old. Not one was the operator's shape. The check was regraded on that evidence, and the grading is stated below rather than hidden.
Two dates are read from the listing record — for a skill/gh/{owner}/{repo} key the repository's own; for a plugin key, skill/plugin/{owner}/{repo}/{plugin}, the resolved source repository's and its owner's, never the marketplace owner's (the marketplace owner is Anthropic on every official entry, which says nothing about the plugin). The listing's age is compared to 30 days and the owner's to 90 days. skill-owner-age is HIGH and 18 points when the owner account is younger than 90 days: the finding reads “owner account created N days ago — younger than 90 days; the ClawHavoc operator's shape”. skill-age is HIGH and 12 points when the listing is younger than 30 days and its owner is younger than 90 days or unknown — “listing created N days ago — younger than 30 days, under an owner not yet established”. The same fresh listing under an established owner is a note at 0 points, and the note says why: “the owner is established, so noted”. Under the default personal profile a HIGH here is a warning — a REVIEW with the ages printed, and an override that records its reason — never a block on its own. Both rows sit in the clone dimension.
Measured on 20 September 2026 through the same code as /v1/skill/score, the check fired on 28 of the 189 skills.sh keys, 0 of the 310 official-marketplace plugins, 1 of the first 100 community plugins and 0 of the malicious set. The 28 are five repositories — 101-skills/superpowers (the listing 19 days old, its owner 74), designed-by-ai/skills (16 days and 16), flowkit-labs/skills (owner 39 days), genmedia-labs/skills (owner 39 days) and prime-skills/runcomfy-agent-skills (owner 69 days) — carrying 31 listings between them on skills.sh, each listing reading the same two dates as its repository. Five signals, not 28. The one community row is sentinal-stack, whose source owner is 36 days old. The official marketplace's zero is the regrading at work: its six first-run rows were fresh repositories from established vendors, and each is now the note.
A real first project on a new account. The five skills.sh repositories above may be exactly that — a developer who joined GitHub this summer and published a set of skills within weeks — and on the day of the install the check cannot tell that from a lure. What it can do is print both ages beside the finding so the reader is judging a 74-day-old account, not a rumour; and the source repository's own verdict rides along through S1, so the same two facts appear once, not twice at different weights.
A fresh repository from an established owner. This was the first run's false fire on the official marketplace and is now a note by design. A note is still printed: a vendor that moved its plugin to a new repository last week will see “the owner is established, so noted” on the report, at no points.
An aged or purchased account. Both thresholds are dates; an account registered a year ago and left idle, or bought, passes them on the day it publishes. That is the owner-account-age gap the repository roster states on its own page, inherited here whole, and the reason the text and script checks exist beside this one. skills.sh's own account age. The leaderboard publishes no account-age API; what is read is the GitHub owner behind the repository, which is the account that can push to it. The content. Two dates say nothing about what the SKILL.md tells an agent to do — that is S9's question — or what the scripts beside it run. ClawHub (@owner/slug) is parsed and routed but not assessed on this tier: the Hub's API carries a createdAt for the listing and this check will read it when the ClawHub fetch ships; until then a ClawHub key answers “not assessed” as a whole, never a pass.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else: npx skills add owner/repo and claude plugin install name@marketplace are shell lines it judges; /plugin install is a slash command the hook never sees; a skill copied by hand into ~/.claude/skills is never seen at all. This tier reads the listing record, the tree once, and at most twelve files of 64 KB each — SKILL.md files first, then a plugin's agents and commands, then the scripts beside each skill; more than fits is a partial scan, stated, and never a pass on what was not read. The deep scan reads the whole package. A PASS means nothing matched on what was read, never that the skill was run.
Both dates are public. For a skills.sh skill the repository is in the listing; for a Claude Code plugin, resolve the entry's source first (the S1 page shows the jq line). Then:
gh api repos/OWNER/REPO --jq '.created_at'
gh api users/OWNER --jq '.created_at'A repository created the same week as the account that owns it is the shape every February listing had. A repository created last week under an account from 2019 is a vendor shipping something new. The check prints both numbers so you can see which one you are looking at.
Why is a young listing only a note when the owner is established? Because a fresh repository from an account that has been on GitHub for years is what every new project looks like, and the first measurement said so: six official-marketplace plugins carried the finding as high on the first run, every one a repository created within the month by a vendor whose account was years old. The shape the check exists for is the February 2026 operator — an account and a listing created in the same few days. So the listing's age is high only when the owner is also younger than 90 days, or unknown; under an established owner it is a note that names the age and says the owner is established. After that change the official marketplace carried the row on no plugin at all.
What does the check read for a Claude Code plugin? The resolved source repository and its owner, never the marketplace's. A plugin key names a marketplace and an entry; the entry's source resolves to a repository — for the official marketplace that is the vendor's own repository, not anthropics/claude-plugins-official — and the created dates read are that repository's and that owner's. Reading the marketplace owner would say only that Anthropic's account is old, which is true of every entry and tells you nothing about the plugin. On ClawHub the listing's createdAt is in the Hub's API and will be read when that fetch ships; until then a ClawHub key is parsed and routed but not assessed on this tier.
Can an attacker wait out the thresholds? Yes, and the page says so. An account aged for a year before use, or one bought, passes both thresholds on the day it publishes — the same gap the owner-account-age check on a repository has, inherited here whole. The February 2026 campaigns did not wait: OpenSourceMalware counts 28 skills published between 27 and 29 January and 386 between 31 January and 2 February, from accounts created for the purpose, and Snyk's clawhub skill reached 7,743 downloads before its removal on 3 February. Age catches the operator who is in a hurry, which so far has been every one on record; the text and script checks are what remain when the operator is patient.
C1 Owner account age — the same 90-day question on a repository, and the aged-account gap stated there · C2 Repository age — the same 30-day question on a repository · S1 Source repository — the source's own verdict, which carries C1 and C2, riding along on every skill · S3 Traction mismatch — the age read against the stars, for a listing popular faster than it is old.
Add RepoGates to Chrome Pricing
Numbers on this page: the 20 September 2026 measurement of 189 skills.sh keys, all 310 official-marketplace plugins, the first 100 community-marketplace plugins and the named incidents, run through the same code as /v1/skill/score; the incident record behind the malicious skills page (OpenSourceMalware, 1 February 2026; Snyk, 4 February 2026; Antiy CERT, 6 February 2026); thresholds and weights from the product's policy and scoring tables.