How skills are reviewed and scanned
A skill reaches the catalog only through a pull request to the public repository, and every pull request runs the same checks. Pick a scenario to see what each check receives and what it passes on.
A pull request adds the skill
The skill lives in cli-tool/components/skills/{category}/{name}/. A contributor PR carries only those files: a guard fails any fork PR that also edits the generated catalog JSON.
.github/workflows/generated-files-guard.yml
The checks
- claude plugin validate. Claude Code's own validator, run on the components a pull request changes and on the whole catalog every week. Errors block the merge. component-validate.yml
- NVIDIA SkillSpector. A static analyzer with 64 vulnerability patterns, run without an LLM. On a pull request it scans the changed skills and plugins and blocks any that score above 50 (high or critical). After merge it scans every component in the catalog, and the result is shown on each component page. skill-security-scan.yml
- Pinned external code. Skills and plugins that live in their author's repository are listed by a
source.jsonpinned to a full commit sha with an allowed license. Upstream changes reach users only through a new pull request that moves the commit and passes every check again. external-skills-outdated.yml - Security audit. Five validators (structure, integrity, semantics, references, provenance) report on every changed Markdown component. component-security-validation.yml
- Code review. Two review bots, cubic and greptile, comment on the diff. The PR gate does not pass while any review thread is unresolved, and a pull request from a fork is always merged by a maintainer. pr-gate.yml
Other component types
Agents, commands, hooks, MCP servers, settings and mods go through the same validator and code review, and SkillSpector
comments on them in the pull request. An MCP server's package must be pinned to an exact version, never
@latest, because it starts on every Claude Code launch.
What this does not promise
Static analysis finds patterns, not intent, and it reports observations that are often expected (a security tool reads credentials, a hook runs commands). The scan result never changes ranking, search or recommendations, including for sponsored placements. Read a component's files before you install it, especially one that runs code.