Agent Skills That Work on Your Machine, Not Just in Chat
There's a class of skill we under-appreciated when we started scoring: the ones whose value isn't in what the agent says, but in what it safely does to your actual system. They're also the class where honest boundaries matter most.
Most agent skills produce artifacts: documents, code, diagrams. A smaller class operates on the machine itself — the browser you're logged into, the apps you've installed, the vault you keep notes in. We scored four of them recently, and they share something interesting: they score well precisely because they're explicit about their side effects — when they touch your system, what they need, and where they stop.
The four
opencli — 9.2 · Developer Tools
Drives your real, already-logged-in Chrome — or calls its 160+ site adapters. The "real Chrome" part is the whole point: you inherit your sessions, cookies, and two-factor logins instead of replaying them in a headless browser. The skill is candid about the trust that requires. It's also bilingual (Chinese and English), which matters for the site adapters.
baoyu-electron-extract — 9.5 · Developer Tools
Extracts resources and JavaScript from any installed Electron app. A reverse-engineering tool, in the legitimate sense — pulling your own app's assets, or auditing what an app ships. Scores 9.5 on content quality because it knows exactly what it can extract from which app structure, and says so.
obsidian-cli — 8.7 · Developer Tools
Interact with Obsidian vaults through the Obsidian CLI. The vault is the user's actual notes; the skill's job is mostly not corrupting them — safe operations, clear previews, no silent writes. That conservatism reads as craft in the scoring.
vercel-cli-with-tokens — 8.4 · Developer Tools
Deploys and manages Vercel projects using token-based auth. The honest one of the group: it exists because token auth has a different failure mode than OAuth login, and the skill walks through what a token can and cannot do.
What makes machine-operating skills different
In our six-dimension scoring, two dimensions behave differently for this class:
Security can't be an afterthought — it's the product. For document skills, security means "don't exfiltrate." For machine skills, security means "define the blast radius." A skill driving your logged-in Chrome can, in principle, do anything you can do. The good ones state which operations they perform, which they refuse, and what they never touch. opencli at 9.2 does this; the average machine-operating skill we see doesn't, and it shows in the score.
Side effects need a dry run. The best pattern in this class is preview-before-execute: show the vault operation, the deploy plan, the extraction manifest — then do it. Skills that execute blind score lower on workflow design even when the underlying capability is the same.
The trust question
We keep a standing security posture for the directory, and machine-operating skills get extra scrutiny for an obvious reason: "drive my logged-in browser" and "harvest my credentials" differ by intent, not by capability. Our credential-harvesting writeup covers what that looks like when it goes wrong — a 60k-star skill that read browser credential databases.
The practical checklist before installing any skill in this class:
- Does it say which operations it performs on your system, specifically?
- Does it have a preview/dry-run mode?
- Does it ask for the minimum access (CLI token vs. full browser profile)?
- Is the source repo inspectable, and does the SKILL.md match what the scripts do?
Four yeses is installable. Three is caution. Fewer is a pass.
Where to browse
These four live in developer tools. If the pattern interests you, our security loadout guide covers how to assemble a working set of skills without giving any of them more reach than they need.