How we verify (and what we don't)
The short version: Skill Harbor is a directory and marketplace for AI skills. We never review the code of a listed skill, and nothing on this site is a safety certification. What we do is run factual, dated checks and print the results on every listing, so you and your agent can decide with real information instead of a promise.
What we check
🧪 VM install test. We run each skill's installation in a disposable virtual machine. The label on a listing shows whether the install passed, failed, or is waiting for a retest, with the test date. This proves the installation works as written. It does not prove the code is safe: a test can succeed on a skill you still should not run.
📌 Pinned version. For skills that download their code from a public repository, the install prompt fetches the exact commit we tested, not whatever the branch points to today. The commit is printed on the listing. If the upstream project moves on, your install still gets the tested version until we test and pin the new one. Listings whose install downloads nothing are not pinned, because there is nothing to pin.
Nightly fingerprint watch. We keep a SHA-256 fingerprint of the files each install downloads and re-check them every night. When a file changes, the listing is flagged "remote content changed since review" until the change is looked at. Install prompts built on our current template also carry the fingerprints, so your own agent re-checks them at install time and stops if a file no longer matches.
🔎 Install prompt analysis. A deterministic scan reads the published install prompt, the exact text your agent will follow, and reports whether it runs commands, makes network calls beyond fetching the skill itself, installs packages, writes files, or uses API keys and tokens. The result is dated, printed on the listing, and the excerpts the scan found are shown there too. It is a reading of the prompt, not an audit of the code behind it.
👁 Observed during the install test. During the VM install test, we record which hosts the installation actually contacts and show them on the listing, with the test date. Three honest limits: this observes the dependency installation inside our Linux sandbox, it does not replay every sentence of the prompt the way your own agent would; the sandbox holds no real keys or accounts, so observation stops at any sign-in step; and a host that does not appear in our test is not proof it is never contacted on a different machine or path.
What the labels mean
📌 Pinned version: the install fetches this exact tested commit.
🧪 VM test: the result and date of our install test in a disposable machine.
🔎 Install prompt analysis: what the prompt asks your agent to do, per our scan.
👁 Observed during the install test: the hosts the installation actually contacted in our sandbox, on that date.
⚠️ Changed since review: a file the install downloads has changed since we last looked.
What we do not do
We do not read or audit the code of listed skills. We do not certify any skill as safe, and no label on this site means "safe". Sellers remain responsible for their own code. A clean test result is a dated fact about one installation run, nothing more.
Your part
Read a skill before you install it, or let your agent do the safety review step the install prompts include. Check what it downloads, what it runs, and what it asks for. If that sounds like work, it is also the only real review in the chain, and it happens on your machine, where it should.
Reporting a problem
Every listing has a Report button that goes straight to our moderation queue. Listings confirmed as malware, phishing, or illegal content are removed. When we flag or remove a listing for safety reasons, the listing says so, with the date.