A skill file is a list of instructions your agent follows with your privileges.

Paste one below — SKILL.md, CLAUDE.md, AGENTS.md, or an MCP config — and this page runs the same nine checks I ran over 300 public SKILL.md files on GitHub. You get the matching line, why it matters, and what to do instead.

Nothing you paste leaves your browser. The checks are nine regular expressions in the JavaScript of this page. There is no upload, no form submission, no analytics and no network request of any kind — open your network tab and watch. You can save this file and run it offline.

Your file

Open a local file

The check runs as you type. Reading a file uses your browser’s own file reader; the contents stay on this machine.

No file to hand? Try one of these built-in examples:

What the nine checks say

Where the baseline comes from

In October 2026 I pulled 300 public SKILL.md files off GitHub code search and ran these nine patterns over them. 45 of the 300 files (15%), across 44 repositories, matched at least one. The scanner, the method and the raw counts are public: field-notes/06-skill-file-scan. This page uses the same regular expressions, translated to JavaScript, with a test that runs both versions over the four examples above and fails if they disagree.

Related reading: arXiv:2609.07360 on configuration exposures in AI coding-agent supply chains, and arXiv:2606.23416 on detecting malicious agent skills in the wild.

What this is not

It is not a verdict. Nine patterns over plain text will miss things that are written differently, and will flag honest files. An installer skill that needs sudo is just an installer skill that needs sudo.
It does not read the code the file points at. A skill that calls a script in the same repo can do anything that script does, and this page never sees it.
It is not a scanner recommendation. For MCP servers specifically, run mcp-audit too — it is free, Apache 2.0, and has 89 rules.

Want a person to read the whole thing instead? Harness Check is a fixed-price human review of one MCP server or skill pack.