Five checks you can do by hand before your agent installs it — and how RepoGates answers them first.
Check before your agent installs. Add the RepoGates plugin to Claude Code with two lines, then every npx skills add and claude plugin install it runs is checked first:
/plugin marketplace add https://repogates.com/plugin/marketplace.json
/plugin install repogates@repogatesSet up the Claude Code plugin Add to Browser — it's free
The plugin's checks run on the paid plans. The browser extension is free to start: it checks GitHub, Hugging Face and GitLab pages and downloads, not skills or plugins.
The short answer. Nobody can tell you a skill or plugin is safe, and a tool that says so is overclaiming. What you can tell in five minutes is whether it is trustworthy enough to install: who published it, what its instructions tell your agent to do, which tools it asks for, what its hooks and servers run, and whether what you install today is what was reviewed.
A skill is instructions your agent follows, and a plugin can add hooks that run on every tool call and MCP servers that start with your session. Published campaigns have used skills that tell the agent to fetch a password-protected archive, decode a base64 string into a shell, or read ~/.aws/credentials. The agent does it because the file said so.
1. Who published it, and since when? Look at the source repository's owner and its age. The documented campaigns ran on fresh accounts.
2. Read the SKILL.md, all of it. Look for a fetch piped into a shell, an archive with a password, a read of a credential file, and anything addressed to the agent rather than to you — including inside an HTML comment, which the rendered page hides.
3. What tools does it ask for? Bash(*) or an agent file with bypassPermissions removes the prompt that would have stopped a bad command.
4. For a plugin: what do its hooks and MCP servers run? Open hooks/hooks.json and .mcp.json. A command that downloads and runs something is the pre-trust execution class.
5. Is the marketplace entry pinned? A plugin whose source has no commit pin installs whatever the branch holds that day.
RepoGates scores an agent skill or Claude Code plugin on 17 published checks, reading the SKILL.md, the scripts beside it and a plugin's hooks and MCP servers, with the source repository through the 22 repository checks on the same pass. It answers through the MCP server's check_skill and the Claude Code plugin, not in the browser. The plugin's hook reads npx skills add and claude plugin install before they run. On the skills.sh leaderboard, Anthropic's official plugin marketplace and the first 100 of its community one, it blocked nothing legitimate; the intelligence page has the campaigns and the run.
The plugin's hook sees Bash tool calls in Claude Code and nothing else: it does not see a command you type in your own terminal or one another agent runs. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. /plugin install typed inside Claude Code is a slash command, not a Bash call, so no hook sees it; neither is a skill copied into ~/.claude/skills by hand. A ClawHub skill is read from its listing record and its published package (under a 512 KB cap); ClawHub declares no source repository and publishes no account record, so those two checks are listed as not checked there. The checks match named shapes in the text — they do not understand intent, and they never claim to detect prompt injection. On the metadata tier at most twelve files per skill source are read; a deep scan reads the whole package, priced in credits by its size before it starts (most are one credit).
Does RepoGates detect prompt injection in a skill? No, and it will not say so. It matches named shapes — a fetch piped to a shell, a password on an archive, a credential read, an instruction to hide something from you — each with a stated false-positive calibration.
Will it see a plugin I install with /plugin install? No. That is a slash command inside Claude Code, not a Bash call, so the hook never sees it. Ask the MCP server's check_skill first, or install from the command line with claude plugin install, which the hook does read.
Is ClawHub covered? Yes: a ClawHub skill is read from the listing's own record — which carries the whole SKILL.md — and its published package, streamed under a 512 KB cap for the scripts beside it. ClawHub declares no source repository and publishes no account record, so S1 and the owner's age are listed as not checked there. ClawHub's own moderation is evidence, never a clearance: a listing it blocked as malware is a critical finding that blocks, one it marks suspicious a warning, and a listing ClawHub no longer serves answers “not assessable”, never a pass.
Set up the Claude Code plugin Add to Browser — it's free Plans
The browser extension is free to start: it puts a verdict on GitHub, Hugging Face and GitLab pages and checks what you download there. It does not check skills or plugins; those checks run through the plugin and the MCP server.
The checks run on the paid plans, through the MCP server and the Claude Code plugin. Numbers on this page: the skills measurement of 20 September 2026 (docs/36).
Asking the wider question — what Claude Code itself decides, and what runs with your permissions anyway? Read Claude Code security: what to check before your agent installs a plugin or skill.
Adding an MCP server rather than a skill? Read what a malicious MCP server is and the six checks to make first.