You already do this for dependencies. Before npm install, some part of your brain checks the weekly downloads, the last commit date, whether the maintainer is a person or a ghost. It is not a
formal process. It is a reflex you built after getting burned.
That reflex has not yet transferred to AI agent skills, plugins, and prompt packs — and those run with a good deal more ambient access than a date-formatting library.
The question everyone skips
Marketplaces answer "what does this do?" very well. Thousands of contributions, ranked by popularity, searchable, one click to install. Breadth is a real answer to a real question.
What they answer poorly is "who made this, and how would I know?" In open marketplaces the honest answer is usually an account name — and an account name is not an identity.
What the audits actually found
One security vendor audited 3,984 publicly shared agent skills and reported 36.82% carrying at least one security flaw, 13.4% with critical issues, and 76 payloads human-confirmed malicious — including a coordinated campaign that pushed 30+ malicious skills into a single public marketplace (Snyk, February 2026). Separately, a live skill was found in the wild stealing developer credentials while disguised as a usage-report upload (Datadog Security Labs, May 2026). Academic surveys across 2025-2026 found moderation in public agent-tool registries to be reactive and community-reported,
with no pre-publication code review and no standardized publisher-identity verification.
Those are point-in-time figures from named third-party research into open AI-agent ecosystems, and none of those studies examined the framework I work on. The pattern is the argument, not any single number — and the pattern is the same one package registries went through a decade ago, at a stage where most of us have not yet built the reflex.
The part worth stealing
You do not need anyone's framework to apply this. Before you install an agent skill, run the same four checks you would run on a dependency:
- Identity — is there a named human or organisation behind it, or only a handle? Can you find them somewhere that predates the listing?
- Readability — can you actually read what it does? Plain instructions you can skim beat opaque code you have to trust, especially for something operating with your file access.
- Provenance of the shelf, not just the item — who decided this belongs here? Pre-publication review, or upload-and-hope?
- Revision history — when this thing was found to be wrong, what happened? Silence is an answer.
Most of the value is in check 1 and check 4. They are cheap, and they are the two that malicious uploads fail most reliably.
The other bet: fewer things, arranged on purpose
There is a structural alternative to a big pile, and it is the one I took building CRAFT for Claude Cowork — a framework that is free and ungated during its beta and runs on Claude Cowork, so you need
Cowork available in your Claude plan; CRAFT adds no cost, account, or gate on top of it.
Instead of a marketplace, it ships a curated shelf: cookbooks, each a set of recipes sequenced around one job so each step hands to the next. Not a search result — an itinerary. You pick which
itinerary, not which pile of parts. The trade is honest and worth naming: you get less breadth. What you get back is that the assembling was done once, by someone accountable for it, instead of by you at the moment you were trying to do something else.
Curation is a floor rather than a ceiling — you write your own recipes on the same structure. But the shelf that ships is not crowd-uploaded.
What "curated" has to mean to be worth anything
A claim of curation is worth exactly as much as what happens when the curator is wrong. So, an example against myself.
Draft copy across nine of our own content files described the framework as open source. The license says otherwise. The framework's own verification pass — recipes whose entire job is checking work, with fact-check gates and 0-100 confidence scoring — flagged the claim, and all nine files were corrected before any of it shipped. That is the kind of error a human reviewer slides past on the tenth read.
The mechanism that matters there is not that we are careful. It is that the check runs whether or not anyone remembers to be careful.
Honest bounds
CRAFT for Claude Cowork is in beta and I say so plainly. Curation is a promise about care, not perfection: cookbooks get revised when they fall short, AI can still make mistakes, and the verification layer exists precisely because of that — review anything consequential yourself. Nothing above is a security guarantee. It is provenance you can inspect, which is a smaller and more
checkable claim.
The four checks in "the part worth stealing" work on anything you install, from anyone, including me. That is the point of them.
Top comments (0)