Five checks you can do by hand before your agent installs it — and how RepoGates answers them first.
The short answer. Nobody can tell you a skill or plugin is safe, and a tool that says so is overclaiming. What you can tell in five minutes is whether it is trustworthy enough to install: who published it, what its instructions tell your agent to do, which tools it asks for, what its hooks and servers run, and whether what you install today is what was reviewed.
A skill is instructions your agent follows, and a plugin can add hooks that run on every tool call and MCP servers that start with your session. Published campaigns have used skills that tell the agent to fetch a password-protected archive, decode a base64 string into a shell, or read ~/.aws/credentials. The agent does it because the file said so.
1. Who published it, and since when? Look at the source repository's owner and its age. The documented campaigns ran on fresh accounts.
2. Read the SKILL.md, all of it. Look for a fetch piped into a shell, an archive with a password, a read of a credential file, and anything addressed to the agent rather than to you — including inside an HTML comment, which the rendered page hides.
3. What tools does it ask for? Bash(*) or an agent file with bypassPermissions removes the prompt that would have stopped a bad command.
4. For a plugin: what do its hooks and MCP servers run? Open hooks/hooks.json and .mcp.json. A command that downloads and runs something is the pre-trust execution class.
5. Is the marketplace entry pinned? A plugin whose source has no commit pin installs whatever the branch holds that day.
RepoGates scores an agent skill or Claude Code plugin on 15 published checks, reading the SKILL.md, the scripts beside it and a plugin's hooks and MCP servers, with the source repository through the 22 repository checks on the same pass. It answers through the MCP server's check_skill and the Claude Code plugin, not in the browser. The plugin's hook reads npx skills add and claude plugin install before they run. On the skills.sh leaderboard, Anthropic's official plugin marketplace and the first 100 of its community one, it blocked nothing legitimate; the intelligence page has the campaigns and the run.
The plugin's hook sees Bash tool calls in Claude Code and nothing else: it does not see a command you type in your own terminal or one another agent runs. /plugin install typed inside Claude Code is a slash command, not a Bash call, so no hook sees it; neither is a skill copied into ~/.claude/skills by hand. ClawHub is not assessed yet. The checks match named shapes in the text — they do not understand intent, and they never claim to detect prompt injection. On the metadata tier at most twelve files per skill source are read; a deep scan reads the whole package, one credit a scan.
Does RepoGates detect prompt injection in a skill? No, and it will not say so. It matches named shapes — a fetch piped to a shell, a password on an archive, a credential read, an instruction to hide something from you — each with a stated false-positive calibration.
Will it see a plugin I install with /plugin install? No. That is a slash command inside Claude Code, not a Bash call, so the hook never sees it. Ask the MCP server's check_skill first, or install from the command line with claude plugin install, which the hook does read.
Is ClawHub covered? Not yet. A ClawHub skill is parsed and reported as not assessed on this tier — never as a pass — until that source ships.
Set up the Claude Code plugin Plans
The checks run on the paid plans, through the MCP server and the Claude Code plugin. Numbers on this page: the skills measurement of 20 September 2026 (docs/36).