Skills.sh Search

• Verdict: Pass
• Confidence: High
• Analyzed: May 1, 2026, 4:51 AM
• Findings: 1
• Version: 1.0.4

Overview

The skill appears to do what it says—search the skills.sh registry—but users should review any third-party skill before following the included install commands.

Safe to use for searching the skills.sh registry. Treat install commands as suggestions, not approvals: review any discovered skill and confirm the intended install scope before adding it to Clawdbot.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI04: Agentic Supply Chain Vulnerabilities

NoteHigh Confidence

What this means

If a user follows the install guidance, they may add third-party skills that can affect future agent behavior.

Why it was flagged

The skill’s documentation guides users from search results to installing third-party agent skills. This is disclosed and related to discovery, but installing external skills can change the agent environment and should be reviewed.

Skill content

After finding a skill, install it using the `skills` CLI:

```bash
npx skills add vercel-labs/agent-skills
```

Recommendation

Before installing a discovered skill, review its source, SKILL.md, permissions, and install scope; prefer project-scoped installation and ask for explicit user confirmation.