Open Source Radar — October 27: Agent Skills Get a Security Scanner
Four projects on today's board sit on the same layer — the skills that tell a coding agent how to behave, how to look and what it may read. The layer now has a supply chain, and someone is finally scanning it.
andrej-karpathy-skills (MIT, ~225,000 stars, 22,486 forks) — A single CLAUDE.md file, and one of the most-starred repos on GitHub, built from Andrej Karpathy's public complaints about coding models: they make assumptions and run with them, they overcomplicate into a thousand lines where a hundred would do, they edit code they don't understand. The file compresses his fixes into four rules — think before coding, simplicity first, surgical changes, goal-driven execution — the last turning "fix the bug" into "write a test that reproduces it, then make it pass", per the project's README. It installs as a Claude Code plugin or a per-project rules file, and ships a Cursor rule with it. The README's own caveat is the honest one: it biases toward caution, so don't run the full ritual on a typo fix.
impeccable (Rust, Apache 2.0, ~89,400 stars) — A design language for coding agents that started from Anthropic's frontend-design skill and turned it into something closer to a linter. The premise is that every model trained on the same SaaS templates, so unguided you get Inter for everything, purple-to-blue gradients and cards nested in cards. It brings twenty-four commands for a shared design vocabulary — polish, audit, critique, distill — plus 62 deterministic detector rules that run with no model and no API key, catching both AI-slop tells like side-tab borders and bounce easing and plain faults like line length and undersized touch targets. It plugs into Claude Code, Copilot, Codex, Cursor and Grok Build. One thing to read before installing: it wires hooks into those harnesses, and its README warns that in Claude Code the hook runs independently of the model's tool approval, so a first edit can fetch and cache its engine even when you denied the command.
SkillSpector (Python, Apache 2.0, ~22,600 stars) — NVIDIA's scanner for the question every agent user now asks: is this skill safe to install? The repo's research number is why it exists — across a 31,132-skill subset of its dataset, 26.1% carried vulnerabilities and 5.2% showed likely malicious intent. It checks 71 patterns in 17 categories, from prompt injection and data exfiltration to memory poisoning, excessive agency and MCP tool poisoning, using fast static analysis with taint tracking and YARA signatures, then an optional model pass for the semantic calls. Feed it a git repo, a URL, a zip, a directory or a single file. It is also the gate in NVIDIA's own Verified Skills pipeline, so anything that passes lands in the company's catalog — which tells you the vendor expects this to become standard practice rather than a nice-to-have.
Agent-Reach (Python, MIT, ~103,900 stars) — Gives CLI agents the parts of the internet they can't reach: GitHub, YouTube transcripts, V2EX, Bilibili and plain web reading work with nothing configured, while Reddit, LinkedIn, XiaoHongShu, Xueqiu and job boards need a login, and X, Facebook and Instagram are still experimental. It installs and tests the scrapers itself, then exposes them as one command with no API fees, returning cleaned structured data instead of raw HTML. The trade-off is in its own security note: for login-walled sites it runs a separate background browser and copies that site's session over from your Chrome. It never reads passwords, but the session it copies is usually your main account, so the README recommends a secondary one. Good deal for a research agent, worth a second thought before you point it at an account you would miss.
Worth watching this week: whether the harnesses ship behaviour and design guidance natively, which would leave most of these skills as the plugins they really are.
Would you install a 225,000-star CLAUDE.md without reading it first? Write to us via our contact page.
