Originally published on rohitraj.tech
Cloudflare, Alibaba and Tencent all shipped official Agent Skills this week, and npx skills add now installs to 78 different agents. Snyk scanned 3,984 skills and found security issues in 36.82% of them. Here is the review gate I run before any skill touches a client repo — what to read, what to diff, what to sandbox, and what to never auto-install.
Read the full version with code samples, diagrams, and architecture details: How to Audit an Agent Skill Before You Install It (2026 Playbook)
More engineering notes: rohitraj.tech/notes
Top comments (0)