Method
How we ran the study.
The corpus, the scanner, how we judged each alert, and the limits of the study, for We scanned 18,750 public AI agent skills, rules and commands.
Corpus
38 repositories, one commit each.
42 cloned, 38 kept, with 1,347,699 GitHub stars between them. 36 of them publish files where rookery 0.3.0 looks.
Public, non-fork GitHub repositories whose main purpose is to publish agent skills, rules, commands, subagents, plugins or agent configuration for others to copy or install.
- Seeds: well-known collections named in advance (verified with gh repo view), plus vendor-official skill repos (Anthropic, OpenAI, Vercel, GitHub, Hugging Face, Cloudflare, Supabase, Expo, Sentry, Trail of Bits).
- Fill: gh search repos by topic (claude-skills, agent-skills, cursor-rules, claude-code-subagents, claude-code-skills, claude-code-commands, cursorrules, agents-md, skills) and keyword (claude skills, agent skills, cursor rules, copilot instructions, claude code subagents, codex skills, SKILL.md), sorted by stars; roughly 1,000+ stars, taking the top skill/rule collections per agent family.
- Excluded before cloning: general apps and frameworks where agent files are incidental (e.g. dify, lobehub, cherry-studio), single-skill repos, and repos under ~1,000 stars unless needed to cover an agent family.
- Excluded after cloning: awesome-lists that contain only links and no agent files (4 repos; listed).
- Snapshot: default branch, git clone --depth 1 on 2026-10-11; commit SHA recorded per repo; star counts read the same day.
Considered and excluded as link-only lists
- BehiSecc/awesome-claude-skills
- VoltAgent/awesome-agent-skills
- hesreallyhim/awesome-claude-code
- travisvn/awesome-claude-skills
The corpus
Default branch of each repository, cloned with git clone --depth 1 on 11 October 2026. Star counts read the same day.
| Repository | Stars | Commit | Agent files found |
|---|---|---|---|
| obra/superpowers | 297,331 | bb92a77741419a4ab5f06e711a283343f1ada0c3 | 20 |
| anthropics/skills | 180,383 | dbd4588f9e1033efb41dad4bef2f7947c8993d44 | 21 |
| addyosmani/agent-skills | 104,602 | 1be8e34187e34647bb83adc3a1323b26ae6f6abe | 51 |
| ComposioHQ/awesome-claude-skills | 76,833 | be2a406907dbc61b73e6827ded415c96139d13a2 | 867 |
| shanraisshan/claude-code-best-practice | 67,364 | 8a831a0d449235fc69fc7e49141a244142644a9e | 47 |
| coreyhaines31/marketingskills | 54,109 | 1efedbc5148b54b2f0f6c6c9fe0be62e151c7fff | 53 |
| kepano/obsidian-skills | 49,381 | 3ccff5338ea700537839b21900aa5358a0402c98 | 8 |
| K-Dense-AI/scientific-agent-skills | 48,324 | 92ace75ac21efe19a620434e0ca4e356081fe807 | 178 |
| sickn33/agentic-awesome-skills | 47,442 | 1c7bdea7f9094080fdb6f8b9b0aefb13030a2e31 | 8,419 |
| PatrickJS/awesome-cursorrules | 40,892 | b044f956f021b6e8877f16781bcfc466a6a120e9 | 257 |
| wshobson/agents | 40,362 | 46891e7e60da0e52baf1050b7b6391b64e84c6d9 | 593 |
| github/awesome-copilot | 39,896 | 82701c24b99488536ca399ff4789a458b7a05db7 | 651 |
| anthropics/claude-plugins-official | 37,644 | f359d43b406057f1a8cdbc4ea93b827642c162e6 | 165 |
| davila7/claude-code-templates | 32,552 | 79182c51fbaa0e5ed14577ffe55b547a6541337a | 1,781 |
| vercel-labs/agent-skills | 32,193 | 063bee94c3f4df8453406c830b0a7df0f2860278 | 15 |
| openai/skills | 27,987 | 49f948faa9258a0c61caceaf225e179651397431 | 44 |
| alirezarezvani/claude-skills | 27,984 | 19392f7a08264ed00486a251f5b2098321771f94 | 802 |
| JimLiu/baoyu-skills | 26,530 | 1567581c26ec29f4216c6e6835415bf30343b0e3 | 24 |
| VoltAgent/awesome-claude-code-subagents | 25,635 | 721e9734670bfaf7283194e234ebb88e94c82dcd | 174 |
| composio-community/awesome-codex-skills | 16,853 | 0930e1373789d2eda449039f7ac154b33031de89 | 881 |
| Jeffallan/claude-skills | 11,816 | 1be15d8064f88fc25216442406d40add8fd23b53 | 85 |
| huggingface/skills | 11,153 | c3ff942be3e07116b475253f0a8fc4f54682c1a8 | 30 |
| trailofbits/skills | 7,470 | 442fc9d6c89b1e937e6f7a477e7071ea75fcbea4 | 181 |
| SnailSploit/Claude-Red | 7,401 | 739512a8588b28ff3b554e669391c22508602878 | 77 |
| Dimillian/Skills | 3,990 | 05ba982bfeb0d77d3c97d4542b0ee15034d05f84 | 16 |
| davepoon/buildwithclaude | 3,615 | fc03a95b41212888c261493630a4803698c1f3c9 | 1,340 |
| sanjeed5/awesome-cursor-rules-mdc | 3,572 | 8fbf26908531c127a6076be0e55fbe17b57fb2d8 | 1,121 |
| cloudflare/skills | 3,033 | c430dd965cea3a8faf0ef035e3b3d73b38518081 | 21 |
| ciembor/agent-rules-books | 2,950 | 893a88a6fce3a80c565bf39ac65021b43a8b2990 | 14 |
| supabase/agent-skills | 2,709 | c9be0e931b7930f7d02126d04774d904c381e7d7 | 5 |
| expo/skills | 2,687 | d4f484024fec15196bfd3c272e953e3f983972cf | 32 |
| rohitg00/awesome-claude-code-toolkit | 2,687 | ebdf1d596d2cde5c5cceb32177e8d1cf4829e7d9 | 563 |
| wshobson/commands | 2,643 | fb091adb62800c7109cdbef47e5d6f55769e99f9 | 0 † (layout not recognised; see note) |
| NeekChaw/RIPER-5 | 2,620 | 67b9837dbae6eaaae7412ee783e6cba414a33c08 | 0 † (layout not recognised; see note) |
| flyeric0212/cursor-rules | 1,891 | f7a354d1185e065715168b08f6439845d5fb391c | 42 |
| instructa/ai-prompts | 1,105 | a426026a0ab270f20e5707056375428d63071664 | 1 † (layout not recognised; see note) |
| getsentry/skills | 1,045 | d18b7aa8ba878354e5c348310230e652f7690f9c | 34 |
| 0xfurai/claude-code-subagents | 1,015 | 9236d10702cdbba37eaa34515f1e1dbff8452506 | 137 |
† Publishes files rookery 0.3.0 doesn’t recognise as agent files: commands whose frontmatter has only a model: line, Cursor rules saved as .md, or free-form prompts. Three repositories are marked. See Limitations.
Tool
One scanner, nothing executed.
The full corpus, 69,839 files, took 82.6 seconds on a laptop.
We installed @thinkingraven/rookery@0.3.0 (rookery commit a49bf53) into its own folder and ran:
rookery scan <repo> --json <repo>.json --infoonce per repository;rookery scan corpus/ --json --html --infoonce over all of them, for cross-repo duplicates.
Nothing in the cloned repositories was executed or installed. All 43 scans completed without errors. The source is on GitHub (opens in a new tab).
Machine: 10-core laptop with another build running (load average 1.9-2.4); timings are indicative.
Verification
Every high-severity alert, read by hand.
These are the alerts we checked and how.
| Alerts | How we checked them |
|---|---|
| All 567 high-confidence high and critical alerts | Read in context |
All 37 high-confidence medium alerts for HTML-comment instructions, sudo and unpinned MCP servers | Read in context |
| 564 “allows any shell command” alerts for skills and commands | Checked from each file’s frontmatter, 22 of them read by hand |
| 28 low-confidence alerts | Spot-checked for anything that should have been high (3 should have been) |
| 42 high-confidence alerts hidden by suppression markers | Rescanned with the markers switched off, then read in context |
Three verdicts
Each alert was classified with a three-way rubric. A real risk means the risk exists as written for someone who installs it, beyond the normal risk of the software the skill is about. Verdicts are judgement calls. The rubric and the verdict counts for each rule are in the data file.
- Real risk
- As written, someone who installs it is exposed to the risk the rule describes, beyond the normal risk of the software the skill is about. Sub-typed vulnerability (unintended, exploitable), by-design (intentional, documented autonomy/permission choice) or hygiene (unpinned packages, broad allow-lists).
- Correct match, harmless here
- The pattern is really there, but in context it is documentation, an opt-in behind a user prompt, a 'bad example', an official vendor installer, a lookup of one named secret the user chose, or an offensive-security technique for use against targets.
- Not a match
- Rookery misread the text: the pattern is not what the rule describes.
Verdicts by rule
High-confidence alerts read by hand: the 567 at high or critical severity (15% real) and the medium rules above.
| Rule | Read | Real | Harmless | No match |
|---|---|---|---|---|
| Hidden Unicode charactersRK-INJ-002 · critical | 30 | 0 | 27 | 3 |
| Agent permission checks bypassedRK-EXE-004 · high | 179 | 28 | 151 | 0 |
| Data sent to a capture or paste serviceRK-EXF-002 · high | 113 | 0 | 112 | 1 |
| Remote script piped to a shellRK-EXE-001 · high | 90 | 0 | 89 | 1 |
| Sweeps password managers, browsers or other projects for secretsRK-EXF-004 · high | 67 | 52 | 15 | 0 |
| Downloads and runs a binaryRK-SUP-001 · high | 42 | 0 | 42 | 0 |
| Hard-coded secret valueRK-SEC-003 · high | 15 | 0 | 11 | 4 |
| Prompt-injection phrasingRK-INJ-001 · high | 11 | 0 | 10 | 1 |
| Obfuscated code executionRK-EXE-003 · high | 7 | 0 | 7 | 0 |
| Reads credential filesRK-EXF-003 · high | 6 | 0 | 6 | 0 |
| Settings allow any shell commandRK-PRM-002 · high | 4 | 4 | 0 | 0 |
| Hook makes network callsRK-HOOK-001 · high | 2 | 0 | 0 | 2 |
| Destructive delete of home or rootRK-EXE-002 · high | 1 | 0 | 1 | 0 |
| Skill or command allows any shell commandRK-PRM-001 · medium | 564 | 564 | 0 | 0 |
| Runs commands with sudoRK-EXE-005 · medium | 27 | 13 | 1 | 13 |
| Unpinned MCP server packageRK-MCP-001 · medium | 7 | 7 | 0 | 0 |
| Instructions hidden in an HTML commentRK-INJ-003 · medium | 3 | 0 | 3 | 0 |
Suppression markers
One collection marks 515 lines with its own scanner’s security-allowlist comments. Rookery honours those markers, so it does not report 69 alerts there, 42 of them high-confidence. We scanned a copy with the markers switched off and read all 42. Every one was harmless: pentest payload examples, a security tool run against a target, a quoted historical attack, and vendor installers. Markers like these can hide alerts, so we checked them rather than trusting them.
Limitations
What this study can’t see.
A scan of text at one point in time, by a scanner that is still young.
Files rookery doesn’t recognise
Two collections publish 215 files that rookery 0.3.0 doesn’t recognise:
- 57 slash commands whose frontmatter has only a
model:line; - 158 Cursor rules saved with a
.mdextension.
We copied them into their install folders and scanned them separately: 5 high-severity alerts, none a real risk. They are not in the report’s totals. One more collection publishes free-form prompts with no frontmatter at all.
Patterns rookery doesn’t catch
Rookery 0.3.0 misses some ways of piping a download into an interpreter: bash <(curl …), sh -c "$(curl …)", curl … | python/ and iwr … | iex. We reviewed all 180 such lines by hand. They were vendor installers, JSON piped into a pretty-printer, or security-testing examples.
Suppression markers
Comments such as security-allowlist switch alerts off. See what they hid here.
One catalogue dominates
One repository holds 45% of all files. We report unique-file counts alongside raw counts for that reason.
Static analysis only
We read text; we didn’t run skills. A skill that downloads its real instructions at run time would look clean.
Point in time
Stars and contents are a snapshot from 11 October 2026.
Reproduce it
Run it yourself.
Scan your own repository in one line, or repeat the whole study.
npx @thinkingraven/rookery scan .To repeat the whole study, clone the repositories above at the listed commits into one folder, then run npx @thinkingraven/.
The data
The data file holds every number on these pages: counts only, with no file paths and no per-file findings.
Updated
Change log.
Published, with numbers from rookery 0.3.0.