Security Is a Floor in the New Batch Too
Security is the one dimension where the new batch is nearly uniform. That is not because the skills are equally safe. It is because the rubric uses security as a floor, and most files clear it.
| Dimension | Mean | Std. dev. | Min | Max |
|---|---|---|---|---|
| Security | 9.17 | 0.58 | 8.0 | 10.0 |
| Workflow | 5.30 | 3.10 | 1.0 | 9.5 |
| Trigger | 5.96 | 2.66 | 1.5 | 9.5 |
Eight of the forty skills score below 9.0 on security. Only one, jira, scores a full 10.0. Nobody scores below 8.0.
The lowest-scoring skills in the batch still score 8.0 to 8.5 on security: shopify-seo at 8.0, ecommerce-ab-testing at 8.5, conversion-rate-optimization at 8.0. A skill can be thin, badly triggered, and still be "safe" in the static sense.
What the security score measures
Our static rubric looks for credential handling, destructive commands, data movement, and prompt-injection surfaces. It is a 20-point factor with a veto: confirmed credential theft, exfiltration, or injection caps the total at 3.9.
Most of these files never touch a destructive operation, so they pass by default. That is why the distribution is compressed.
What it does not measure
It does not run the skill. It does not sandbox the agent, feed it adversarial documents, or check whether the skill follows its own confirmation rules under pressure. That is a separate, dynamic test; the published dataset is at /data.
A file can score 9.5 on static security and still fail a scope-overreach probe in the sandbox. The two measurements answer different questions.
The reading
Do not use security to rank these skills. Use it as a gate: anything below the floor is disqualified; above the floor, the ranking is decided by trigger, structure, workflow, content, and engineering.
This is the same conclusion we reached in Security Is a Floor, Not a Differentiator, with a new batch behind it. The floor is real. It is just not the interesting part of the ranking.