skill-up
An evaluation and evolution tool for Agent Skills.
No outside reports on file
Use this tool only in controlled environments with test data, never with real user information, and carefully review any skill definitions before evaluation runs.
Based on public adoption and transparency signals as of Oct 21, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesReads & writes local foldersREVIEW
- Command executionNo shell command runner notedLOW
- Network reachLocal or standard API callsLOW
- CredentialsNo API token requiredLOW
- Package sourceGitHub (alibaba/skill-up)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
No npm or PyPI package is listed. Install from source: github.com/alibaba/skill-up ↗
Everything known
We found nothing about this project in the sources we read (last checked 2026-10-30). That does not mean it has no problems.
0 incidents · 0 advisories · 0 news articles · 0 community threads · checked 2026-10-30
Popularity grade: B (from public signals such as stars and downloads, not a code review). Graded 2026-10-21.
Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.
About Skill Up
Skill-up is a tool from Alibaba that helps evaluate and improve AI agent skills. It appears to test how well AI agents perform tasks and suggests ways to make them work better.
Who it’s for
Developers and researchers building AI agents who want to measure performance and find improvements. Teams working with large language models that need to automate complex skills.
Alternatives
- Langchain Agent Evaluation: Framework for testing AI agent chains with built-in benchmarks. - LlamaIndex Evaluation Tools: Methods for measuring retrieval and generation quality in agents. - AutoGen: Microsoft's framework with agent testing and logging capabilities. - Promptfoo: Tool for evaluating and comparing LLM outputs systematically.
Setup
Check these steps against the project’s own instructions before running anything.
Follow the project's README
Why this grade
Signal-based grade (4/7 points): well starred on GitHub, listed in several sources, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 1.4k
- Listing last refreshed
- 2026-10-30
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Risks to watch for
- Code execution risk: The tool may run untrusted code to test agent skills, which could access local files or system resources if not properly sandboxed. - Data leakage during evaluation: Test inputs and outputs used to evaluate skills could contain sensitive information that gets logged or stored. - Prompt injection in skill definitions: Malicious skill descriptions could trick the AI agent into performing unintended actions. - Network access: The tool may need internet access to call AI models, creating a channel for data exfiltration. - Dependency vulnerabilities: Like any npm/pip package, it could depend on libraries with security flaws.
How to lower the risk
Least-privilege permissions
- Run only on isolated development machines, not production servers.
- Use read-only test datasets for evaluation.
Network isolation
- Test in environments without access to internal databases or APIs.
- Monitor all outbound connections to detect unexpected data transfers.
Monitoring
- Log all skill evaluations and review what data was used.
- Watch for skills that request access beyond their stated purpose.
Red flags to watch for
- Skill definitions that seem overly complex or obfuscated.
- Unusual file system or network requests during testing.
- Performance drops that might indicate resource-stealing code.
Questions
How do I install Skill Up?
Skill Up does not publish a standalone npm or PyPI package. Clone or follow the setup instructions in its source repository at github.com/alibaba/skill-up.
Are there security reports about Skill Up?
No reports found for this package in our research (last checked 2026-10-30). Skill Up currently holds Grade B (Some risk signals) based on public adoption and transparency signals. Key risk areas to watch include code execution risk.
Is Skill Up actively maintained?
Skill Up has 1.4k GitHub stars. Our directory data was last refreshed on 2026-10-30. Check recent commit activity, release tags, and open issues at github.com/alibaba/skill-up before pinning it in production.
What are alternatives to Skill Up?
Notable alternatives to Skill Up include Langchain Agent Evaluation (Framework for testing AI agent chains with built-in benchmarks. - **LlamaIndex Evaluation Tools**: Methods for measuring retrieval and generation quality in agents. - **AutoGen**: Microsoft's framework with agent testing and logging capabilities. - **Promptfoo**: Tool for evaluating and comparing LLM outputs systematically). You can also compare Skill Up side by side with other skills in the Related tools section on this page.
README badge and team notes
Maintain or use Skill Up? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/alibaba-skill-up)HTML embed:
<a href="https://agentarmorhq.com/skills/alibaba-skill-up"><img src="https://agentarmorhq.com/api/badge/alibaba-skill-up" alt="AgentArmorHQ Risk Grade for Skill Up" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "alibaba-skill-up"Share with your security lead
Need sign-off to use skill-up? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: skill-up
- **Listing URL:** https://agentarmorhq.com/skills/alibaba-skill-up
- **Type:** AI agent skill
- **Risk Grade:** Grade B (Some risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 1.4k GitHub stars
#### Permission & Blast-Radius Signals
- **Local files:** Reads & writes local folders
- **Command execution:** No shell command runner noted
- **Network reach:** Local or standard API calls
- **Credentials:** No API token required
- **Package source:** GitHub (alibaba/skill-up)
#### Recommended Hardened Setup
- **Source Repo:** https://github.com/alibaba/skill-up
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 21, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- AI agent skill
- Publisher
- alibaba
- Source code
- github.com/alibaba/skill-up
- Est. context load
- ~50 tokens idle · ~450 tokens when active (on-demand skill)
- Popularity
- 1.4k GitHub stars
- Last updated
- 2026-10-30
- Last graded
- 2026-10-21
Community
Discussions for Skill Up
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude