Safety box score: how skills are rated
A safety box score rates the reach of a skill, not its intent: what an agent could do to the machine, accounts and data of someone who installs it. It is a grade from A (minimal risk) to F (high risk), with a 0 to 100 risk-point total and a level for each of eight categories. The score is built from the skill's own files and is a snapshot of them at rating time.
How a rating is made
- Inventory and scan. Every file in the skill folder is listed. The text files (the
SKILL.md, docs, config, and scripts in shell, Python, JavaScript, TypeScript, PowerShell and other languages) are read and matched line by line against about sixty risk signals, such as piping a download into a shell,sudo, reading~/.aws,rm -rf, instructions to skip confirmations, and encoded blobs. Each signal has a category and a severity. Binaries that cannot be read count against transparency. - Model review. The files, the inventory and the scan hits go to a language model with fixed instructions. It rates each category from 0 to 3 with a one-sentence rationale, lists findings with the file and the quoted evidence, and writes a short “before you install” checklist. The scan hits are hints the model must confirm or dismiss. Skill files are treated as evidence, never as instructions: a skill that tells the agent to ignore its rules gets that noted as a finding.
- Grade. The grade is computed in code, never by the model. Category levels are weighted and summed, the sum becomes 0 to 100 risk points, and the points map to a grade. Any category at level 3 caps the grade at C; two or more cap it at D.
The eight categories
Each category is rated 0 (none), 1 (low), 2 (moderate) or 3 (high). The weight is how much the category counts toward the risk points.
| Category | The question it answers | Weight |
|---|---|---|
| Code & shell execution | Does it run scripts, shell commands or evaluate code? | 1 |
| Network access | Does it download files or send data to remote hosts? | 1 |
| Filesystem reach | Does it read, write or delete outside the project? | 1 |
| Secrets & credentials | Does it touch tokens, keys, passwords or credential stores? | 1.5 |
| Privilege & persistence | Does it need sudo, install globally, or change shell or OS settings? | 1.5 |
| Instruction hijack surface | Does it tell the agent to skip confirmations, follow remote instructions or ignore its rules? | 1.5 |
| Irreversible actions | Does it push, deploy, send, pay or delete without a human check? | 1 |
| Transparency | Is there obfuscated code, binaries or unverifiable downloads? | 1 |
Grade bands
| Grade | Label | Risk points |
|---|---|---|
| A | Minimal risk | 0 to 10 |
| B | Low risk | 11 to 25 |
| C | Moderate risk | 26 to 45 |
| D | Elevated risk | 46 to 65 |
| F | High risk | 66 to 100 |
What the score is not
It is an automated reading of the files at the moment of rating, not a security audit, and it cannot see what a skill fetches at run time. A skill that changes in its repository keeps its old score until someone re-rates it; every skill page has a re-rate button. Read the findings and the “before you install” checklist, not just the letter, and treat a grade as one input to your own judgement.
Browse skills or read what an agent skill is.