skills

The open agent skills ecosystem

Latest 1.7.2

NPM

89%

Total Score

healthy

Active releases and an organization-backed repository outweigh minor workflow and security-policy gaps.

Are you affected? Scan for Free

Health Score Breakdown

Lifecycle scripts

A prepare lifecycle script runs during installation, adding execution at install time. This is a modest supply-chain and reproducibility concern for a CLI package, even though the release also has build provenance.

Security policy

The repository has no published security policy. This is a transparency gap for a widely used package, although active maintenance and security scanning provide partial compensation.

Workflow audit

All three workflows were analyzed with no injection, untrusted-checkout, or severity findings, and one scopes permissions at job level. However, 10 of 16 action references are unpinned, which is a workflow supply-chain hygiene gap.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-501836 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. skills is vulnerable to Command Injection in versions 1.1.0 - 1.5.15.	1.1.0 - 1.5.15	High
AIKIDO-2026-10126 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. skills is vulnerable to Path Traversal in versions 0.0.1 - 1.1.8.	0.0.1 - 1.1.8	Medium