AgentArmorHQ
Sign in

skills

Skill · npm · graded 2026-10-24Source linked

The open agent skills ecosystem

No outside reports on file

This is a widely-used building block for AI agents, but the skills you add with it need careful review since they run with your agent's permissions and can access sensitive data or make network calls.

Based on public adoption and transparency signals as of Oct 23, 2026. Our opinion, not a code audit or security guarantee.

Was this verdict for Skills helpful?

What it can access

  • Local filesReads & writes local foldersREVIEW
  • Command executionNo shell command runner notedLOW
  • Network reachConnects to outside service APINOTED
  • CredentialsNo API token requiredLOW
  • Package sourcenpm (skills)PUBLIC

Inferred from this listing’s public package details and description. Check the project’s source before installing.

Install

npx -y skills

All setup options ↓

Check this skillWatch it in my stackCompareREADME badgeView project

Everything known

We found nothing about this project in the sources we read (last checked 2026-10-30). That does not mean it has no problems.

0 incidents · 0 advisories · 0 news articles · 0 community threads · checked 2026-10-30

Popularity grade: B (from public signals such as stars and downloads, not a code review). Graded 2026-10-24.

Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.

Check a specific version →

About Skills

skills is an open-source AI agent skill focused on General. The open agent skills ecosystem.

Who it’s for

Developers building AI agents or AI applications who want to add custom abilities like web browsing, data processing, or API calls. Teams using Vercel's AI tools may find it most relevant.

Alternatives

  • LangChain tools: Similar agent tool ecosystem with broader community and documentation.
  • OpenAI function calling: Native capability for structuring AI agent functions.
  • AnthropicTools (Claude MCP): Model Context Protocol for extending Claude's abilities.
  • AWS Lambda + bedrock-agents: Cloud-based agent skill framework from AWS.

Setup

Check these steps against the project’s own instructions before running anything.

Follow the project's README at https://github.com/vercel-labs/skills.git (opens external site) for installation and configuration instructions specific to your use case.

Why this grade

BB — Some risk signals

Signal-based grade (5/7 points): very widely starred on GitHub, heavily downloaded, no public source code found. This reflects adoption and transparency, not a code review.

Popularity and upkeep

46/100
Weekly npm downloads
4.1M
Listing last refreshed
2026-10-27

These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.

Risks to watch for

  • Data exposure through skills: Skills running on your system could access local files, environment variables, or API keys if not properly sandboxed.
  • Untrusted skill code: Skills downloaded from npm could contain malicious code that runs with your agent's full permissions.
  • Prompt injection: An attacker could craft inputs that trick the AI into using a skill in unintended ways, like calling an API with wrong parameters.
  • Network access: Skills might make requests to external services, potentially leaking data or allowing remote control.
  • Supply chain risk: Popular packages can be compromised; 2.2M weekly downloads means many systems depend on this code.

How to lower the risk

Least-privilege permissions

  • Only grant skills access to APIs or data they actually need.
  • Use separate API keys for each skill when possible.

Network isolation

  • Monitor or restrict outbound network calls from skills.
  • Run skills in isolated environments if they're from untrusted sources.

Monitoring

  • Log all skill calls and their inputs/outputs.
  • Review skill behavior regularly for unexpected activity.

Red flags to watch for

  • Skills requesting access to sensitive files or credentials.
  • Network calls to unexpected domains or IPs.
  • Skills that modify system settings or install additional code.

Questions

How do I install Skills?

Install Skills with npm install skills or run it directly with npx -y skills. Pin an exact version and pass --ignore-scripts if you want to block post-install hooks.

Are there security reports about Skills?

No reports found for this package in our research (last checked 2026-10-30). Skills currently holds Grade B (Some risk signals) based on public adoption and transparency signals. Key risk areas to watch include data exposure through skills, untrusted skill code, prompt injection.

Is Skills actively maintained?

Skills has 4.1M weekly npm downloads, with its latest repository commit pushed on 2026-10-19. Our directory data was last refreshed on 2026-10-27. Check recent commit activity, release tags, and open issues before pinning it in production.

What are alternatives to Skills?

Notable alternatives to Skills include LangChain tools (Similar agent tool ecosystem with broader community and documentation), OpenAI function calling (Native capability for structuring AI agent functions), AnthropicTools (Claude MCP) (Model Context Protocol for extending Claude's abilities), AWS Lambda + bedrock-agents (Cloud-based agent skill framework from AWS). You can also compare Skills side by side with other skills in the Related tools section on this page.

README badge and team notes

Maintain or use Skills? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.

AgentArmorHQ Risk Grade B for Skills

GitHub README Markdown:

markdown
[![AgentArmorHQ Risk Grade for Skills](https://agentarmorhq.com/api/badge/vercel-labs-skills)](https://agentarmorhq.com/skills/vercel-labs-skills)

HTML embed:

html
<a href="https://agentarmorhq.com/skills/vercel-labs-skills"><img src="https://agentarmorhq.com/api/badge/vercel-labs-skills" alt="AgentArmorHQ Risk Grade for Skills" height="20" /></a>

Terminal check:

terminal
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "vercel-labs-skills"

Share with your security lead

Need sign-off to use skills? Copy this note for Slack, a ticket or a pull request.

### AgentArmorHQ Security Review Memo: skills
- **Listing URL:** https://agentarmorhq.com/skills/vercel-labs-skills
- **Type:** AI agent skill
- **Risk Grade:** Grade B (Some risk signals)
- **Outside Security Advisories on File:** 0

#### Permission & Blast-Radius Signals
- **Local files:** Reads & writes local folders
- **Command execution:** No shell command runner noted
- **Network reach:** Connects to outside service API
- **Credentials:** No API token required
- **Package source:** npm (skills)

#### Recommended Hardened Setup
- **Command:** `npx -y --ignore-scripts skills`
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.

_Based on public adoption and transparency signals as of Oct 23, 2026. Our opinion, not a code audit or security guarantee._

Key facts

Type
AI agent skill
Install command
npm install skills
Est. context load
~50 tokens idle · ~450 tokens when active (on-demand skill)
Popularity
4.1M weekly npm downloads
Last updated
2026-10-27
Last graded
2026-10-24

Community

Discussions for Skills

Ask questions or share configuration tips. Governed by our Community Rules & Terms.

No posts match this filter yet.

Be the first to ask a question or share a working tip.

Was this listing for Skills helpful?

Check before you install, in Claude

Your assistant answers Block, Review or No known issues for any package before it installs it.

Get this check inside Claude