Check S4 · provenance family · severity HIGH · automatic · one of the 15 skill and plugin checks
The question this check asks: is this owner one edit away from an owner people know, or is this listing's name the name of a skill or plugin that belongs to someone else? A skill is installed by name. An operator who takes a name the reader already trusts — or the marketplace's own — does not need a convincing SKILL.md; the name does the work. This check compares the owner and the listing name against a list of the ones worth imitating.
The clearest case in the record is Snyk's advisory of 4 February 2026. Two skills by the ClawHub account zaycv: clawhub, the marketplace's own name taken as a slug, “masquerading as an official CLI tool for managing agent skills”, at 7,743 downloads before its removal on 3 February; and clawdhub1, one insertion away from it. There is no skill literally named clawdhub — that is Snyk's name for the campaign, not a listing. The Hacker News, quoting Koi Security's 1 February audit, lists ClawHub typosquats among the disguises the wider ClawHavoc campaign wore — a figure this page carries as quoted from Koi by The Hacker News, because Koi's own write-up could not be read. Snyk's ToxicSkills fixtures of 5 February include a fake vercel skill, the name of a vendor with real skills on skills.sh. The malicious skills page has the record and the measurement.
The repository roster's fork-and-lookalike check reads the same shape on a repository name. A skill has two names to imitate — the owner's and the listing's — and one more complication: a repository of thirty skills will name some of them the way other people do, under any owner. How the check handles that is the substance of this page.
Two rows, each HIGH and 18 points. skill-lookalike:owner fires when the owner is within one edit — one character inserted, deleted or changed — of a known owner, and only when the name is four characters or more; the finding reads “owner 'X' is one edit from 'Y' — lookalike pattern”. skill-lookalike:name fires when the listing name equals, or is within one edit of, a known skill or plugin name that belongs to a different owner — “name is within one edit of 'owner/name' under a different owner — lookalike pattern” — unless two known owners already share that name, in which case it is generic and never matched. A known owner-and-name pair is the original and is never a lookalike of anything. Under the default personal profile a HIGH is a warning, a REVIEW with the matched name printed; the rows sit in the clone dimension.
Two rules decide what is compared, and both came out of the first measurement. On a plugin key the owner tested is the resolved source owner — the entry's source is resolved to a repository first, and that repository's owner is compared — so a catalogue entry is never a lookalike of itself. Before that rule the official marketplace's 250 entries and 98 of the community's fired, every one a plugin listed under anthropics whose known name belonged to the vendor's own repository; after it, none. And the listing name is compared on every key, while the names of the skills inside a repository are compared only when the owner account is younger than 90 days: a year-old organisation hosting a skill called figma is not imitating Figma, but two accounts weeks old publishing the same thirty directories is the shape the check wants. The reference data is backend/policy/skills-known.json, generated on 20 September 2026 by tools/skills_known.py: 2,873 skills and 282 owners — the official marketplace's plugin source owners, the owners on skills.sh, ClawHub's top 100 handles and anthropics, never the community catalogue's self-serve owners — with 31 ambiguous names that two known owners share and are therefore never matched.
Measured on 20 September 2026 through the same code as /v1/skill/score, the check fired on 3 of the 189 skills.sh keys, 0 of the 310 official-marketplace plugins, 0 of the first 100 community plugins and 0 of the malicious set. The three: 101-skills/superpowers and its listing, whose listing name matches obra/superpowers and whose inner agent-browser — compared because the owner is 74 days old — matches vercel-labs/agent-browser; and genmedia-labs/skills, matched to prime-skills/ace-step because the two young owners publish the same thirty directories. The cost of the inner-name rule is also in the record: the ToxicSkills operator's repository, aztr0nutzs/NET_NiNjA.v1.2, carries a copy of agent-manager under an account 331 days old, and this check does not flag it. The row is a REVIEW on its three archives through S10, and the repository is on the campaign blocklist besides — but the lookalike row is not there, and the page says so.
A fork or a re-publication under a young account. Two of the three skills.sh rows are a young owner republishing directories that a known owner also publishes; the check cannot tell a fork made in good faith from a clone made to be found, and does not try — it names the match, at HIGH, and the reader sees the two repositories side by side. A coincidence of handles: an owner whose name happens to be one letter from a known owner's will be matched, and the finding prints both so that the coincidence is visible. Both are the fork-and-lookalike case the repository roster states on its own page, inherited here.
An inner skill name under an established owner. That is the rule's stated cost, above, and the reason S1 and the campaign blocklist sit beside it. A name two edits away. One edit is the typosquat; two is a different name, and widening the window would flag most of the 2,873. A name outside the reference list. The list is the owners and names worth imitating as of its generation date; a vendor that joined skills.sh yesterday is not in it until the file is regenerated. What the skill does. A lookalike name is a reason to read the SKILL.md, and the reading is S9's. ClawHub (@owner/slug) is parsed and routed but not assessed on this tier: the reference data already carries ClawHub's top 100 handles, so the comparison is ready, but the Hub's ownerHandle and slug are read only when the ClawHub fetch ships; until then a ClawHub key answers “not assessed” as a whole, never a pass.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else: npx skills add owner/repo and claude plugin install name@marketplace are shell lines it judges; /plugin install is a slash command the hook never sees; a skill copied by hand into ~/.claude/skills is never seen at all. This tier reads the listing record, the tree once, and at most twelve files of 64 KB each — SKILL.md files first, then a plugin's agents and commands, then the scripts beside each skill; more than fits is a partial scan, stated, and never a pass on what was not read. The deep scan reads the whole package. A PASS means nothing matched on what was read, never that the skill was run.
Search the marketplace for the name before you install it, and look at who else has it. On skills.sh the search box answers by name; on GitHub:
gh search repos NAME --json fullName,stargazersCount,createdAt --limit 10If the name you were about to install belongs to an older, better-known owner under a slightly different spelling, you have found what this check finds. For a Claude Code plugin, the official catalogue lists every name it carries — jq '.plugins[].name' on the marketplace file the S1 page shows how to fetch — and a plugin offered elsewhere under one of those names, by a different owner, is the shape.
Why is the listing name always compared but an inner skill name only under a young owner? Because a repository of thirty skills will, under any owner, contain names that other people also use — a year-old organisation hosting a skill called figma is not imitating Figma — while the listing name is the one thing a reader types and the one thing a typosquat imitates. So the listing name is compared on every key, and the names of the skills inside are compared only when the owner account is younger than 90 days, the operator's shape. The measurement shows the rule from both sides: genmedia-labs/skills, under a 39-day-old owner, was matched to prime-skills/ace-step because two young owners published the same thirty directories; and aztr0nutzs' copy of agent-manager, under a 331-day-old account, was not flagged. That second case is the cost of the rule, and the record states it rather than hiding it.
Why did the first run flag 250 official plugins? Because the first version compared a plugin's marketplace owner, and every entry in the official catalogue is listed under anthropics while its known name belongs to the vendor's own repository — so the catalogue looked like 250 lookalikes of itself, and the community catalogue like 98. The rule now compares the resolved source owner: for a plugin key the entry's source is resolved to a repository first, and it is that repository's owner who is tested against the known list. A known owner-and-name pair is the original, never a lookalike. On the second run both counts were zero, with nothing else about the rule changed.
Which names count as known? A reference file generated on 20 September 2026 by a tool in the repository: 2,873 skill and plugin names and 282 owners, drawn from the official marketplace's plugin source owners, the owners published on skills.sh, ClawHub's top 100 handles and anthropics itself — never the community catalogue's self-serve owners, because a list anyone can join is not a list worth imitating. 31 names that two or more known owners already share are marked ambiguous and never matched, so a generic name is not a lookalike of anyone. A name is compared only when it is four characters or more, so a two-letter slug cannot be one edit from everything. The file is regenerated by the same tool and the difference reviewed.
C4 Fork and lookalike — the same one-edit rule on a repository name, and the fork question this roster leaves to the source · S2 Listing and owner age — the 90-day owner age that decides whether inner names are compared · S1 Source repository — the source's own verdict and the campaign blocklist, which is what denies a re-registered name.
Add RepoGates to Chrome Pricing
Numbers on this page: the 20 September 2026 measurement of 189 skills.sh keys, all 310 official-marketplace plugins, the first 100 community-marketplace plugins and the named incidents, run through the same code as /v1/skill/score; the reference file generated the same day; the incident record behind the malicious skills page (Snyk, 4 and 5 February 2026; The Hacker News quoting Koi Security, 2 February 2026); thresholds and weights from the product's policy and scoring tables.