B — Some risk signals Graded October 16, 2026Minor concerns worth a quick check.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
AI agent skill · Developer tools
agents
Multi-harness agentic plugin marketplace for Claude Code, Codex, Cursor, OpenCode, GitHub Copilot, Google Antigravity, and Pi
Bottom line: Signal-based grade (4/7 points): very widely starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
- Popularity score
- 51/100
- Rank
- #102 of 500
- GitHub stars
- 40.9k
What it does
A plugin marketplace that integrates AI agent skills across multiple coding assistants including Claude, Cursor, GitHub Copilot, and others. Enables developers to extend their AI tools with reusable, composable capabilities through a centralized harness system.
Who it’s for
Developers and technical teams using multiple AI coding assistants who want to standardize and share agent capabilities across platforms. Engineering leaders seeking to consolidate AI tooling and skill management.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Verify against the repo README at https://github.com/wshobson/agents (opens external site) for current installation instructions, as setup varies by target platform (Claude Desktop, Cursor, GitHub Copilot, etc.). The repository should provide platform-specific configuration snippets and integration guides.
Risks
- Plugin execution scope: Agent skills may inherit broad permissions from host IDE or coding assistant; verify each skill's required access level before deployment
- Supply chain exposure: Community-contributed plugins lack centralized security review; malicious or compromised skills could exfiltrate code, credentials, or API keys
- Prompt injection vectors: Untrusted plugin outputs fed into LLM contexts may manipulate agent behavior or bypass guardrails
- Credential handling: Skills may request API keys or authentication tokens; no documented standard for secure credential storage or isolation
- Maintenance gaps: High star count doesn't guarantee active security patching; verify recent commit history and vulnerability disclosure process
How to stay secure
Least-privilege permissions
- Audit each skill's requested IDE permissions before installation; restrict to minimum required scope (e.g., "read workspace files" vs. "full filesystem access")
- Disable skill access to credential managers, environment variables, and secrets stores unless explicitly needed; use isolated API key containers instead
- Use IDE permission sandboxing features (e.g., Cursor's plugin isolation mode) to limit inter-plugin communication and host system access
- Revoke permissions immediately for unused or outdated skills; treat skill updates as re-approval events requiring fresh permission review
Network isolation
- Configure network policies to restrict skills to approved API endpoints only; block unauthorized exfiltration vectors (e.g., webhook callbacks, DNS tunneling)
- Require all skill network traffic through authenticated proxies or VPNs with traffic logging; inspect for unexpected outbound connections
- Disable skills' ability to make arbitrary HTTP requests; whitelist only documented third-party APIs (GitHub, OpenAI, etc.)
- Route credentials through isolated credential injection layers rather than allowing skills direct environment variable access
Monitoring
- Enable audit logging for skill execution, including inputs, outputs, and API calls; flag skills accessing sensitive files or credentials
- Monitor for unusual resource consumption or runtime behavior (e.g., infinite loops, memory spikes, repeated failed auth attempts)
- Track skill output for prompt injection payloads before feeding results into agent context; implement semantic validation on LLM-bound outputs
- Alert on any skill attempting to modify its own permissions, escape sandbox, or access other plugins' isolated storage
Red flags to watch for
- Skills requesting "full workspace" or "system command execution" permissions; legitimate tools rarely need unrestricted filesystem or shell access
- Community plugins with few downloads, no recent commits (>6 months stale), or missing vulnerability disclosure policy
- Vague skill documentation, obfuscated code, or dependencies on obscure third-party libraries with no clear security audits
- Skills that request API keys/credentials but lack documented encryption, secure storage, or clear credential lifecycle management
Alternatives
- Anthropic's official Claude integrations and MCP (Model Context Protocol) servers for native, audited capability expansion
- GitHub Copilot Extensions marketplace (GitHub's first-party, curated alternative for Copilot skill management)
- Cursor's native plugin system and extensions for IDE-level capability management
- LangChain or LlamaIndex tool/agent frameworks for programmatic, self-hosted multi-agent orchestration