Check S11 · execution surface family · severity LOW · automatic · one of the 15 skill and plugin checks
The question this check asks: how much of this skill is there to read? A SKILL.md is a document an agent loads whole every time the skill is invoked, and the specification asks authors to keep it under 500 lines. A skill that carries dozens of files is a package, and this tier opens twelve of them. S11 counts both and says so — a note, never a score.
For two readers. The first is the agent. Anthropic's guidance in the Agent Skills specification is one line: “Keep your main SKILL.md under 500 lines” — move the reference material into references/, keep the instruction short enough to be read. A SKILL.md that runs to thousands of lines is a document no one reads to the end, and text nobody reads is where an instruction can sit unremarked. The second reader is this tier. It reads the first 64 KB of each file, at most twelve files across eight skills, and a file past 65,536 bytes is read to its first 64 KB and no further. Size is where a scanner's read stops. Noting it says where this one's stopped.
That is also why the note is not a defence, and this page says so rather than implying otherwise. The Cloud Security Alliance's audit of 10 June 2026 bypassed ClawHub's VirusTotal Code Insight by whitespace inflation — roughly 100,000 newlines placed before the payload, so the scanner's read ended before the instruction began. The same audit found Cisco's scanner bypassed by a precompiled .pyc and skills.sh's audits by a payload inside a DOCX; three of the four bypasses took under an hour to develop, and no single scanner caught all four. Its conclusion — “Don't outsource trust to a scanner” — is the right reading of this check: a skill whose SKILL.md is over the guidance is a skill this tier read part of, and the note is the tier telling you that. The malicious skills page has the audit in its record.
Two rows, both INFO, both 0 points, both allow under every shipped profile. Neither is ever a driver, and a skill carrying both is still a PASS if nothing else matched on what was read.
skill-oversize fires when a SKILL.md exceeds 500 lines or 65,536 bytes, and reads “<dir>/SKILL.md: N lines, N bytes — over Anthropic's own guidance (500 lines)” with the file's own counts — the first such file under the key, one row. The count is of the text this tier holds, which for a file over 64 KB is its first 64 KB: the byte figure in the finding is a floor, not the file's true length. skill-many-files fires when more than 50 files sit under a skill directory — or under the plugin as a whole, on a plugin key — and reads “skills/x: 137 files — more than the 50 a skill usually needs”. That count comes from the tree, which is read once and whole, so it includes files this tier never opened.
What sits beside these rows is the point. When the twelve reads are spent before every skill file is open, the scan carries the note “partial scan — N of M skill files unread (this tier reads 12 per key, 8 skills)”, keeps a short TTL and is retried; it is never a pass on what was not read. The 64 KB cut on a single file is the same posture at a finer grain: the hidden-Unicode, instruction-shape and credential-redirect checks run on what was read, and the size note is what tells you there was more. Measured on 20 September 2026 through the same code as /v1/skill/score, across 189 skills.sh keys, all 310 official-marketplace plugins, the first 100 community plugins and the malicious set, this check fired nothing above INFO on any set — by construction, since it has nothing above INFO to fire.
A skill that is genuinely long. A reference skill that carries a whole API surface in its SKILL.md is over the guidance and doing nothing wrong; the specification's advice is to move that text into references/, and many authors have not. That is why the row is a note and why the finding names the file: the judgement is yours, and the check's only claim is the count.
A plugin that is a plugin. Agents, commands, hooks, a bundled MCP server and its dependencies pass 50 files without trying, and a committed node_modules/ beside a skill is counted with everything else, because the count is of what is in the tree. The same applies to a skill that ships test fixtures or sample data. None of it moves the score.
What the bytes say. Size is a count; the instruction shapes are S9's question and the scripts beside the skill are S10's, and both run only on what was read. The trick itself. A SKILL.md padded with 100,000 blank lines carries the size note, and the payload past the 64 KB cut is not read on this tier — the note is the whole of what S11 says about it, and the deep scan, which reads every file at its full length, is the tool for a skill whose size is the point. Files the tier never opened, counted but not read: a skill with more than fifty files is one this tier read twelve of. ClawHub (@owner/slug) is parsed and routed but not assessed on this tier: its API answers a SKILL.md as text, but no size row is produced until the ClawHub fetch ships, and a ClawHub key as a whole answers “not assessed” — never a pass.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else: npx skills add owner/repo and claude plugin install name@marketplace are shell lines it judges; /plugin install is a slash command the hook never sees; a skill copied by hand into ~/.claude/skills is never seen at all. This tier reads the listing record, the tree once, and at most twelve files of 64 KB each — SKILL.md files first, then a plugin's agents and commands, then the scripts beside each skill; more than fits is a partial scan, stated, and never a pass on what was not read. The deep scan reads the whole package. A PASS means nothing matched on what was read, never that the skill was run.
Three counts, from inside the skill directory:
wc -l SKILL.md # lines — the guidance is 500
wc -c SKILL.md # bytes — this tier reads the first 65,536
find . -type f | wc -l # files under the skillAnd one comparison that costs nothing:
grep -c . SKILL.md # lines with anything on themThe gap between wc -l and that figure is blank lines. A SKILL.md where the gap is most of the file is one to open in an editor and scroll to the bottom of, because whatever it says is down there.
Why is size only a note? Because a long file is not a fault. The Agent Skills specification asks authors to keep the main SKILL.md under 500 lines, and plenty of real skills do not; a plugin that ships agents, commands, hooks and a server passes 50 files by design. Neither row moves the score, and neither is ever a driver. What the note tells you is where this tier's read stopped: a file is read to its first 64 KB, at most twelve files across eight skills, and a skill bigger than that is one the tier read part of. The finding names the file and the count so you can judge the rest yourself.
What happens to a SKILL.md larger than 64 KB? It is read to its first 64 KB and no further. The text checks — hidden Unicode, the instruction shapes, the credential redirect — run on what was read, the size note says the file is over 65,536 bytes, and nothing past the cut is graded on this tier. That is not a pass on the rest; it is a stated limit. The deep scan reads the whole package, every file at its full length, and is the tool for a skill whose size is the point.
Does this check catch whitespace inflation? No. The Cloud Security Alliance's 10 June 2026 audit bypassed ClawHub's VirusTotal Code Insight by placing roughly 100,000 newlines in front of the payload, so the scanner's read ended before the instruction began. A SKILL.md padded that way would be over 500 lines and would carry the size note; the payload itself would sit past the 64 KB this tier reads, and the note is what tells you so. A note on size is a note, not a defence. The deep scan reads the whole package, and CSA's own conclusion — do not outsource trust to a scanner — applies to this one.
S5 Frontmatter validity — the other half of the specification: the fields the SKILL.md must carry, where S11 is the length it should not exceed · S10 Scripts and executables — what the files beside the SKILL.md do, including the .pyc and the archive this tier lists but does not read · S9 Instruction shapes — what the text says, on the part of it that was read.
Add RepoGates to Chrome Pricing
Numbers on this page: the thresholds from the product's policy tables (500 lines, 65,536 bytes, 50 files; twelve reads of 64 KB across eight skills); the 20 September 2026 measurement of 189 skills.sh keys, all 310 official-marketplace plugins, the first 100 community-marketplace plugins and the malicious set, run through the same code as /v1/skill/score; the Agent Skills specification's guidance; and the Cloud Security Alliance's scanner audit of 10 June 2026, in the record behind the malicious skills page.