Four lists through the sixteen skill checks · skills.sh, Anthropic's official plugin marketplace and the first 100 of its community marketplace on 10 October 2026, ClawHub's top 99 on 25 September 2026 · no skill and no author named
What this is. The four lists people install AI-agent skills and Claude Code plugins from, run through RepoGates' sixteen skill checks (S1–S16), each at its latest measurement. This page counts; it does not name. No skill, no plugin, no author and no repository appears on it, because a verdict on a listing nobody has reported is a statement about that author, and the author has not asked for one. A REVIEW or a BLOCK below is not an accusation.
A PASS means every check that could run, ran, and none fired; it is never a guarantee. A note (an INFO line) does not count as firing. A check that could not run is listed as not checked, never passed. And none of these figures is a catch rate: these are popular listings that nobody has reported malicious, so what the checks flag here is what a developer meets on ordinary code. Confirmed malicious incidents, each with its date and primary source, are on Malicious skills and plugins.
| List | Measured | Keys | PASS | REVIEW | BLOCK | Partial scans |
|---|---|---|---|---|---|---|
| skills.sh | 10 Oct 2026 | 187 | 151 | 10 | 26 | 24 |
| Anthropic's official plugin marketplace | 10 Oct 2026 | 310 | 282 | 28 | 0 | 111 |
| Anthropic's community plugin marketplace, first 100 | 10 Oct 2026 | 100 | 94 | 5 | 1 | 23 |
| ClawHub, its own top 100 by downloads | 25 Sep 2026 | 99 | 83 | 16 | 0 | 13 |
A key is one thing the checks give a verdict on: a repository of skills, one skill directory inside it, a plugin, or a ClawHub listing. A partial scan is a key on which something was not read — more files than the cap below, or a package that did not arrive in time — and the checks that needed it are listed as not checked. The record is RepoGates' own measurement file, docs/36, with the rows of every key kept beside it; every figure on this page is taken from those rows.
npx skills add owner/repo installs), and 159 skill
directories inside them, each measured on its own: 187 keys. 23
listings name a skill directory the repository's tree did not hold
that day, and were left out rather than guessed.The three October lists were run on 10 October 2026 through the same code that answers the verdict API, from a laptop, under the product's 6.5-second deadline. ClawHub's was run the same way on 25 September 2026, with the fifteen checks of that day; the sixteenth, S16, was first measured on 10 October.
There are 27 BLOCKs on the October lists, 26 on skills.sh and 1 on the community hundred, and every one comes from S1, the source repository: the skill's own source repository scored BLOCK through RepoGates' 22 repository checks, and a skill is its source repository. In all 27, that repository's BLOCK is its owner's account: younger than 90 days when it was measured (the account-age check; a new account is a pattern those campaigns used, and also how most first projects start). The same 27 keys carry S2, the young owner, on the skill itself. They come from five source repositories; on skills.sh one repository is many keys, because each of its skills is measured too.
This is a provenance signal, not proof of malice. No BLOCK on these lists came from anything the checks read in a skill's text or scripts, and no skills.sh skill and no plugin in either Anthropic marketplace has been named malicious by a primary source, as the incidents page records. A first project on a new account looks, on the day of the install, exactly like a lure published from a new account, and the checks cannot tell the two apart; time can. Such a BLOCK gets the action a clone of the same repository gets under the same policy, never stricter, and an override records the reason. S1 has graded a BLOCK source repository critical since 27 September 2026, by the owner's decision.
The number of keys on which each check fired above a note — a medium, high or critical finding — on each list, most frequent first. A key can carry more than one. Checks that fired on no key are listed below the table.
| Check | What it found, in plain words | skills.sh | Official | Community | ClawHub |
|---|---|---|---|---|---|
| S5 Frontmatter validity | The SKILL.md header is off: a name that differs from its directory, a name outside the specification's shape, a header that does not parse, or no description. | 6 | 11 | 5 | 11 |
| S1 Source repository | The skill's source repository is itself BLOCK under the 22 repository checks. | 26 | 0 | 1 | not checked |
| S2 Listing and owner age | The owner's account is younger than 90 days. | 26 | 0 | 1 | 0 |
| S9 Instruction shapes | A line of the skill's text matches one of the named shapes: a fetch piped into a shell, a read of a credential store, a permission bypass, or data sent out. | 0 | 9 | 2 | 1 |
| S10 Scripts and executables | An archive or an executable inside a skill directory, or a script written to be hard to read. | 2 | 7 | 0 | 0 |
| S4 Lookalike owner or name | A skill declares the same name as a known skill published by someone else. | 3 | 2 | 0 | 4 |
| S6 Declared tool surface | A skill asks for wide tool grants (a shell, file writes). | 1 | 0 | 0 | 0 |
| S15 Credential redirect | An AI provider's base address is assigned to a host other than the provider's, so the key would go there; the one here is the plugin's own host (high), not a stranger's (critical). | 0 | 1 | 0 | 0 |
No key on any list fired S3 (traction), S7 (declared requirements), S8 (hidden Unicode), S11 (size), S12 (marketplace source pinning), S13 (hooks and monitors), S14 (MCP servers) or S16 (declared versus actual behaviour, October lists only) above a note. S16 wrote ten notes on the October lists and changed no verdict.
S9 matches these shapes with a negation window; it does not detect prompt injection, and it can match a sentence that only describes the shape. The one S9 finding on ClawHub is that case: a skill that vets other skills lists, as a warning, the very line the shape matches. It is the one misread on ClawHub, 1 of 99, found when every ClawHub REVIEW was read by hand. The October REVIEWs were not read by hand again; the hand-reading of the same three lists on 20 September is on False-positive rates.
SKILL.md whole. It is the
instruction your agent will follow. Look for a line that fetches
something and pipes it into a shell, a password-protected archive,
reads of ~/.ssh, ~/.aws or a
.env file, and anything that tells the agent to skip
its confirmations.ANTHROPIC_BASE_URL or OPENAI_BASE_URL at
another host sends your key there.SKILL.md
first and scripts last. On the October lists it read 3,178 files
and left 3,541 unread; such a key is a partial scan, and a check
that is quiet there is quiet about what was read. The deep scan
reads the whole package when you start one; it costs credits./plugin install command. The RepoGates
hook in Claude Code sees Bash tool calls, so npx skills
add and claude plugin install are lines it
judges; /plugin install is a slash command the hook never sees.
RepoGates does not see git clone, package managers or
curl — outside Claude Code with the RepoGates plugin,
whose hook refuses a clone or install that names a blocked
repository on the command line, before it runs. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies.~/.claude/skills,
pasted from a chat or unpacked from a zip has no listing and no
record to read, and nothing here is said about it.The published campaigns — on ClawHub, and the skills shown to work inside Claude Code — are on Malicious skills and plugins, each with its date and primary source. That page names what its sources name. This one names nothing, and each figure here will be measured again, and the date changed, when the checks or the lists move.