How We Evaluate Skills
Every skill on Skill123 is scored on the same six-dimension rubric — 100 points total — with written rationale for every score. This page is the full methodology, so you can check our work.
The six dimensions
1. Trigger Quality
A skill's description is its recall mechanism — it decides whether the skill fires at the right moment. We check: does the description state what the skill does, when to use it, and when not to? Does it cover the phrasings a user would actually type? The best descriptions read like they were written by someone who watched real users miss the skill ten times.
2. Structure
Progressive disclosure is the whole game: a lean SKILL.md (under 500 lines) with details offloaded to references/, scripts in scripts/, templates in assets/. We penalize bloated single files, broken paths, and skills that ship READMEs they don't need.
3. Workflow Design
The heaviest dimension. A skill should tell the agent how, not describe what. We look for: task-oriented steps, the right freedom gradient (exact commands for risky actions, room for judgment in creative ones), error handling, and a verification loop — a step that checks the result before claiming done.
4. Content Quality
Concise, imperative, executable. Commands with real arguments, not "run the tool with the appropriate options."
5. Engineering
Valid frontmatter, runnable scripts, file paths that actually resolve in the shipped package. You'd be surprised how many published skills reference files they forgot to include.
6. Security & Compliance
Static analysis of every script and document. Before scoring, we enumerate the skill's capability manifest: data sources read, side effects, network destinations, credential access, and persistence changes. That manifest is compared against what the trigger description promises — the gap between the two is the clearest security signal there is.
The security veto
Confirmed credential theft, backdoors, data exfiltration, or prompt injection caps the total score at 39/100 — regardless of how good the engineering is. This isn't theoretical: we delisted a skill with a five-figure GitHub star count after its scripts were found parsing Safari's cookie store and decrypting Chromium credential databases via the macOS Keychain. Nobody reads the scripts. That's the whole problem.
What a scorecard looks like
Every skill page shows: the six-dimension bars with per-dimension written rationale, the overall verdict, and the radar chart. No black-box ratings — if you think trigger quality deserves fewer than 20 points, read the full guide and tell us. The rubric gets better exactly this way.
Limitations
Honest ones: evaluation is automated analysis plus human curation, not a formal audit. Our scores assess the skill package as shipped — a skill that downloads code at runtime can be scored only on what it ships. We recommend users still inspect skills before installing; our scorecards are a filter, not a guarantee.