What happened
If you’ve looked up AI skills on YouTube, you’ve seen the “top 10 skills” videos. When they tell you how to pick one, it usually comes down to GitHub stars. More stars, more trust.
Stars are useful. They tell you a lot of people have looked at something. But in 2024, a research team led by Carnegie Mellon found about 4.5 million suspected fake stars on GitHub, and most of the projects buying them were short-lived malware.
So I did what those videos skip. I opened a real skill, my own. It’s called nifty-swing-screen and it screens fifty Indian stocks every morning. By day I’m an IT auditor, so checking things before trusting them is literally my job.
A skill is a folder that teaches an AI agent one job, and the agent only opens it when that job comes up. Think of a new joiner at work. You don’t hand them every manual on day one. You give them a list of what manuals exist, and they pull the payroll manual when a payroll question comes up. Anthropic created this format for Claude and made it an open standard on December 18th, 2025. The official site now lists more than 40 tools that read it, including ChatGPT and Codex, Gemini CLI, GitHub Copilot, Cursor, Databricks and Snowflake.
Here’s what’s inside mine:
nifty-swing-screen/
SKILL.md (required: name, description, instructions)
scripts/
run_screen.py (about 300 lines of Python)
assets/The open spec also allows a references folder for longer documentation. I don’t need one. Only SKILL.md is required.
At the top of SKILL.md, between the dashes, are two fields: a name and a description. The description can be up to 1,024 characters, and it matters more than anything else in the file. Below that is plain English: my strategy rules, entry conditions, stop loss, position sizing. About 880 words, no code. It reads like a procedure manual, because that’s what it is.
Where the control failed
The description is the trigger. When an agent starts up, it reads only the name and description of every skill it has, about a hundred tokens per skill by the spec. When I type “run my swing screen”, the agent matches the description and only then reads the full instructions, which the spec recommends keeping under 5,000 tokens. If the instructions say “run the script”, it opens the script. The spec calls this progressive disclosure.
I’ll be honest about mine. My description is 870 characters. That’s well over the hundred-token guideline, because I stuffed it with every phrase I might type. It works, but it costs context in every single conversation, even ones about cooking.
The bigger issue is the scripts folder. When the instructions say “run the bundled script”, the agent doesn’t read the file and think about it. It runs it, on my machine, in my terminal. A skill runs with the agent’s permissions. On most laptops, that means your files, your terminal, and any keys you’ve saved.
The audit word here is supply chain risk: the thing that hurts you is something you didn’t build but chose to trust.
Early this year, it happened. OpenClaw is an open-source AI assistant with a public skills marketplace called ClawHub. In February, the security firm Koi Security checked 2,857 skills there and found 341 malicious ones. Some told users to install a fake “prerequisite” that was actually malware. One, dressed up as a weather assistant, read the agent’s settings file, which held API keys, and sent it to an outside server. On Macs, one payload stole saved passwords, SSH keys and crypto wallets. Some of that malware had thousands of downloads. Reports put the total pulled from ClawHub at more than 2,400 skills, and it now scans uploads with VirusTotal.
Anthropic’s own documentation says it plainly: use skills only from trusted sources, and treat them like installing software.
The evidence an auditor should ask for
The quickest check I know doesn’t need a programmer. I don’t read all 300 lines of run_screen.py. I read the imports, the lines at the top that list which tools the code borrows. Most are housekeeping. pandas does the maths. Then there’s yfinance, the one that talks to the internet. It pulls prices from Yahoo Finance.
Is that a problem? No. A stock screener needs stock prices. The test isn’t whether a skill touches the internet. It’s whether what it touches matches what it says it does. A weather skill that reads your password file fails that test, and on ClawHub one did.
If your job is governing these tools, ask three more questions:
- Is there an inventory? Does anyone know which skills are installed across the organisation?
- Who approved it? Is there change control for skills, like there is for code?
- What can the agent reach when it runs? Least privilege, or the whole laptop?
If nobody can answer those three, you’ve found your audit finding.
My auditor’s take, and it’s an opinion, not a statistic: people check which AI model they’re using and what data they feed it. Almost nobody checks which add-ons the agent has loaded. That’s where I’d look first.
The test to run this week
Pick one skill you’ve installed, or one you’re about to, and run these four checks. No coding needed.
- Check who published it. An official vendor or a team you know is different from a random account. Stars and download counts are fine for a shortlist. They aren’t proof.
- Read the SKILL.md yourself. It’s plain English. Be suspicious of any skill that tells you to install a “prerequisite”, paste a command into your terminal, or download something from a link. That’s exactly how the ClawHub attacks worked.
- Look in the scripts folder and read the imports. Does what it touches match what it says it does? If there’s code you can’t follow, don’t run it on the machine that holds your passwords and keys.
- Keep the approval prompts on. Many agent tools ask before they run a command. Don’t switch that off for something you just downloaded.
Ten minutes ago in the video, this was a mystery folder. Now you know it’s a job description, a procedure, and some code. In the next Build Lab, I build one from scratch so you can see what a good one looks like.