Check S3 · provenance family · severity HIGH · automatic · one of the 15 skill and plugin checks
The question this check asks: is this listing popular faster than it is old? A skill that is two weeks old and has a hundred stars is either the launch of the month or a number someone bought, and the check cannot tell which — it can only say that the popularity has outrun the provenance, print both figures, and let the reader look. On the marketplace where the February 2026 campaigns ran, the popularity was the lure.
A download count is the first thing a reader sees and the easiest thing an operator can manufacture. OpenSourceMalware's write-up of 1 February 2026 records one ClawHub publisher, hightower6eu, who by its count “alone accounts for almost 7000 downloads” across 354 skills — published within days. Snyk's advisory of 4 February records the clawhub skill at 7,743 downloads before the marketplace removed it on 3 February. Neither listing had been on the Hub for a fortnight. Whether the numbers were generated by the operator or by victims, the effect was the same: a skill that looked established because thousands had taken it. The malicious skills page has the record and the measurement.
The repository roster reads the same shape on a GitHub repository as star velocity, because fake-maintainer campaigns bought stars for the same reason. On a skill the number that matters is whichever the marketplace shows the reader — stars on GitHub, installs on ClawHub — and on one marketplace there is no number to read at all, which this page states plainly rather than working around.
skill-traction-mismatch is HIGH and 20 points. On a GitHub-sourced key — a skill/gh/{owner}/{repo} listing, or a plugin whose marketplace entry resolves to a repository — it fires when the repository has 100 stars or more and is younger than 14 days; the finding reads “N stars on a repository N days old — traction outrunning provenance”. On ClawHub the number is installs: 5,000 or more on a listing younger than 14 days. Both thresholds are policy values, printed here so that a reader can hold the product to them. Under the default personal profile a HIGH is a warning — a REVIEW with both figures on the report — never a block on its own; the row sits in the clone dimension. On skills.sh the per-skill install count has no API — the site's leaderboard header reads “All Time (1,480,226)”, its unit unlabelled, and nothing more can be quoted from it — so the install side of the check is a stated skip on that source, listed on the report, and the GitHub repository's stars are what is read against its age.
Measured on 20 September 2026 through the same code as /v1/skill/score, the check fired on nothing: 0 of the 189 skills.sh keys, 0 of the 310 official-marketplace plugins, 0 of the first 100 community plugins, 0 of the malicious set. The zero is what the lists contain, not a property of the check. The five young skills.sh repositories that carried the age findings of S2 had not reached 100 stars; the marketplace plugins are vendors' repositories months or years old; and the malicious set's GitHub repositories — Snyk's fixtures and the ToxicSkills operator's — were never starred. The shape the check was written for, thousands of installs within days, lived on ClawHub, which this tier does not yet read.
A launch that went well. A skill announced on a busy forum can pass 100 stars in its first week; the finding will name it, at HIGH, and the reader will see a two-week-old repository with a hundred stars and a maintainer who is answering issues. That is the star-velocity case the repository roster states on its own page, inherited whole. The finding prints the count and the age so that the reader is judging numbers, and an override records its reason. The threshold is set where a genuine launch clears it rarely and a bought count clears it always; a genuine launch that clears it is a REVIEW for the two weeks it takes to age past the window.
The install count on skills.sh. There is no per-skill API, so the check does not read one, does not guess one from the leaderboard, and lists the skip. A count bought after the window. Fourteen days is the window in which a number cannot honestly be large; stars bought on day 20 are read by the repository roster's velocity check on the source, which rides along through S1, not by this one. What the skill does. A popular skill and a malicious one are the same skill in the February record; the number is a reason to look, and the looking is S9's and S10's. ClawHub (@owner/slug) is parsed and routed but not assessed on this tier: the Hub's API carries stats.installs and a createdAt, which is exactly this check's input, and the check will read them when the ClawHub fetch ships; until then a ClawHub key answers “not assessed” as a whole, never a pass.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else: npx skills add owner/repo and claude plugin install name@marketplace are shell lines it judges; /plugin install is a slash command the hook never sees; a skill copied by hand into ~/.claude/skills is never seen at all. This tier reads the listing record, the tree once, and at most twelve files of 64 KB each — SKILL.md files first, then a plugin's agents and commands, then the scripts beside each skill; more than fits is a partial scan, stated, and never a pass on what was not read. The deep scan reads the whole package. A PASS means nothing matched on what was read, never that the skill was run.
For a GitHub-sourced skill, both numbers are one call away:
gh api repos/OWNER/REPO --jq '[.stargazers_count, .created_at]'Then open the stargazers list. A hundred accounts that all joined GitHub the same month and star nothing else is a bought number; a hundred accounts with histories is a launch. On ClawHub the listing page shows the install count and the publication date side by side; compare them the same way. On skills.sh, look at the repository behind the listing — the leaderboard figure is not a per-skill count and should not be read as one.
Why did this check fire on nothing in the measurement? Because nothing on the three top lists was both younger than 14 days and past 100 stars, and the check reports what it read, not what it hoped for. The young repositories on skills.sh in September 2026 had few stars; the official and community marketplaces are vendors' repositories months or years old; and the malicious set's GitHub repositories were not starred. A zero on a check that measures a rare shape is the honest result, and it is printed with the sets it was measured on so that a later run can be compared. It is not a promise: the shape the check exists for — thousands of downloads on a listing days old — was on ClawHub, which this tier does not yet read.
Why is skills.sh a skip rather than a read? Because there is no per-skill install count to read. skills.sh publishes a leaderboard whose header reads “All Time (1,480,226)”, with the unit unlabelled, and offers no API that answers a single skill's installs. RepoGates does not guess a number it cannot fetch and does not invent one from the leaderboard. On a skills.sh listing the check reads the GitHub repository's stars against its age — the source repository is what npx skills add installs — and states that the install count is not assessed. A skip is listed on the report; it is never a pass.
What counts as traction on ClawHub? Installs. The Hub's API carries stats.installs and a createdAt for every listing, and the threshold is 5,000 installs or more on a listing younger than 14 days — the scale OpenSourceMalware recorded for one operator, hightower6eu, who by its count “alone accounts for almost 7000 downloads” across 354 skills within days of publishing them. That read is the ClawHub fetch, which has not shipped; until it does, ClawHub (@owner/slug) is parsed and routed but not assessed on this tier, and a ClawHub key answers “not assessed” rather than a pass.
C3 Star velocity and traction — the same shape on a repository, with its own thresholds, riding along on the source · S2 Listing and owner age — the age this check compares the count against · S4 Lookalike owner or name — the other way a listing borrows a reputation it has not earned.
Add RepoGates to Chrome Pricing
Numbers on this page: the 20 September 2026 measurement of 189 skills.sh keys, all 310 official-marketplace plugins, the first 100 community-marketplace plugins and the named incidents, run through the same code as /v1/skill/score; the incident record behind the malicious skills page (OpenSourceMalware, 1 February 2026; Snyk, 4 February 2026); the skills.sh leaderboard header as read on 20 September 2026; thresholds and weights from the product's policy and scoring tables.