Scan any week’s crop of open-source AI releases (Matthew Berman’s curation rounds are a good sample), and a pattern separates itself from the tool noise. The projects gathering six-figure star counts are increasingly skill files: practitioners packaging how they think into instructions an agent can run. A veteran developer educator ships his entire engineering practice as skills. The president of Y Combinator writes down how he interrogates startups into an ordered sequence your agent can walk you through. Whole security frameworks (MITRE ATT&CK, NIST, fraud models co-developed by major banks) arrive as a paste-one-URL install (and Rent the model, own the method covers making your own from a session you admired). The way expertise gets shared has changed, and it changes both how you should adopt it and what you should fear.
01The judgment ships too
What these repositories sell is a working method, shaped by what the author learned the hard way. The tell is the tagline on the most-starred of them: skills for real engineering, not vibe coding. The value of such a collection is that somebody spent a career learning which questions to ask and in which order, then wrote that down in a form your agent can execute. Which means the right way to evaluate one is to read the skill files themselves and ask whose judgment this encodes, and whether that judgment is one you would take as mentorship if it came from a person. It would be strange to adopt a mentor by popularity alone; the file deserves the same scrutiny.
02The ordering is the product
The best of these collections are explicit that the ordering is the product.
“He describes G Stack as a process, not a collection of tools.”
Matthew Berman, on Garry Tan's skills, “You NEED to try these 12 open-source AI projects RIGHT NOW” · 9:43Think, plan, build, review, test, ship, reflect, with an office-hours-style interrogation before any of it, where the agent grills you about the problem space, the solution, and the team the way a YC partner would. Each stage exists to catch what the previous one produced, and that is precisely where the encoded judgment lives. Cherry-pick the build skill and skip the interrogation, and you keep the fast, mechanical part while discarding the judgment. Run the sequence in order at least once before you decide what to prune: the stages you are most tempted to skip are usually the ones the author added after being burned.
03Scan it like untrusted input
Now the fear. A skill is plain-language instruction that your agent will obey with your credentials, your files, and your tools. That makes a malicious skill categorically different from a malicious library: it does not need a vulnerable code path, it just needs your agent’s obedience. The way in is instruction-following itself (prompt injection, data theft, privilege escalation, an agent doing more than you intended), and the install culture of paste-a-URL-and-say-install is exactly the ease attackers love. The ecosystem knows it: one of the projects in the same curation round is NVIDIA’s security scanner for agent skills, checking dozens of vulnerability patterns across sixteen categories before anything reaches your agent.
“Anytime you're about to install a skill, you should first … inspect it.”
Matthew Berman, “You NEED to try these 12 open-source AI projects RIGHT NOW” · 12:01The discipline is the same one this publication applies to sources: nothing gets in unread. The arithmetic favors it too: 20 minutes of reading is cheap insurance against an instruction that walks off with your credentials. Scan with a purpose-built tool where one exists; where it does not, have a separate agent session (one with no tools and no access), the same fresh-context verifier pattern Guardrails for hours-long agent runs leans on, read the skill and answer three questions. What does this instruct my agent to do with data it touches? What does it tell my agent to fetch, send, or execute? And is there any instruction addressed to the agent that the installing human was clearly not meant to read?
The whole vetting pass, with rough time costs:
| Step | Time it takes | What it catches |
|---|---|---|
| Read the top-level skill files | 20 minutes | Whether there is a real process, or just a feature list |
| Vet the author | 10 minutes | Judgment you would not take as mentorship |
| Scan like untrusted input | 5 minutes | Injection, data theft, an agent doing more than you intended |
| Run the full sequence once, in order | 2 hours | The stage you wanted to skip, and what it exists to catch |
Further reading
- Matthew Berman · You NEED to try these 12 open-source AI projects RIGHT NOW, the curation round this guide samples
- Anthropic · agent skills documentation, how skill files load and run
- MITRE ATT&CK, one of the security frameworks now shipping as skills
- Wikipedia · supply chain attack, the class of risk an installable skill belongs to
- Anthropic · engineering blog, first-party practice from the tool vendor