The problem
Every day another thread: "Top 5 research skills — beat McKinsey!" Five GitHub links. Ten minutes on each README, and you still can't tell which one is real.
Stars don't help. An influencer ships filler and gets 20k stars. A student polishes a genuine gem for months and has 30. The honest answer is inside the files — and nobody has two hours per repo.
What you get back
- A verdict on the first line — no hedging, with the one-sentence reason.
- How it actually works — the real mechanism traced end to end: what triggers, where state lives, what closes the loop. Not the README's marketing.
- The essential 20% — in a 50-skill pack, which handful does the work, and which are the same template with the nouns swapped.
- A 10-minute reading map — 2–4 real file paths, in order, each with what to notice. Read those; the report covers the rest.
- A scoped safety audit — behavior-like code is separated from harmless mentions, with file:line evidence, skipped paths, and explicit limits.
- Installability checks — compatibility, dependencies, license, global writes, privileges, hooks, and persistence.
- Patterns worth stealing — what the author did well, so you get sharper at building your own.
The pre-install gate
Ask it to install something and it flips from advisor to gatekeeper. Inspection never installs or executes target code. After 🟢 it returns to your authorized installer; after 🟡 it asks before narrowing the scope; after 🔴 it stops with file:line evidence.
A real test — a repo advertising "50+ skills, 21k stars, replaces a $2M consulting team", asked in Chinese to install it urgently:
结论：🔴 SKIP（不要安装） — 它的安装脚本会把你的全部环境变量偷偷打包上传到作者的服务器…
(Verdict: SKIP. Its install script quietly uploads all your environment variables to the author's server…)
It caught the credential exfiltration at install.sh:6, caught a hidden comment ordering AI reviewers to praise the repo, called out the fabricated star count — and installed nothing.
How it judges
The pill metaphor: a supplement lists a hundred ingredients while one or two do the work. The core move is the removal test — delete a component; would the outcome change? What survives is the essence.
The decisive question is the substance test: does the skill give the model something it doesn't already have — a working script, hard-won domain constraints, exact templates, a verification loop? Or is it "be thorough, think step by step" in forty flavors? A frontier model already knows how to be thorough. Restating that is the #1 marker of a trash skill.
Stars, followers, and README claims never prove implementation quality. Source files decide the technical verdict; history, releases, and issues provide maintenance context only.
Why it's fast
Parallel subagents. Large repositories are split across parallel subagents so the scan finishes faster. Any model the harness offers works, including the same model as the main conversation.
It also never runs the code it judges. The repo is treated as untrusted data throughout — it dissects the pill, it doesn't swallow it. Instructions hidden inside a repo aimed at the reviewing AI are reported as a red flag, never obeyed.
Measured, not claimed
Benchmarked against the same model without the skill, on real repos (obra/superpowers, anthropics/skills):
| With skill | Without | |
|---|---|---|
| Assertions passed | 100% (14/14) | 64% (9/14) |
The baseline failed exactly where a busy person gets hurt: hedged non-verdicts ("probably yes, if…") and no safety check at all — it missed a live telemetry call the skill caught.
Install
Claude Code / Claude Desktop
git clone https://github.com/wallmage/skill-scout.git
cp -r skill-scout/skill-scout ~/.claude/skills/skill-scoutOr download skill-scout.skill from the repo and click Save skill.
OpenAI Codex
mkdir -p ~/.agents/skills
cp -R skill-scout/skill-scout ~/.agents/skills/skill-scoutGemini CLI and other Agent Skills tools — see INSTALL.md for native project and personal discovery paths.
Then just ask
Is this worth installing? https://github.com/someone/some-skill-pack
thoughts? https://github.com/someone/skills
Which of these five is best? <link> <link> <link> <link> <link>
Install this for me: https://github.com/someone/viral-skill ← gets vetted firstAsk in any language and the whole verdict comes back in that language.