What a verified badge actually means
The registry checks every skill with three separate auditors on one shared verdict scale. Here's what each one looks for and why lint alone isn't the safety review.
Contents
Passing skillmd lint tells you a SKILL.md is well-formed. It does not tell you the skill is safe to run, and treating those as the same check is the most common way people misread a verified badge. They’re separate steps, done by separate tools, at separate times, and understanding the difference is worth five minutes before you decide how much to trust one.
Lint is not the safety review
Lint is deterministic and you can run it yourself, right now, before you publish anything: frontmatter is well-formed, required fields are present, the body has a heading and isn’t a stub. It catches structural problems. It has no opinion on whether the instructions inside the body are safe to follow.
The safety review is a separate, later step, done after publish, by auditors that read the actual content of the skill, including companion files beyond SKILL.md itself, and render a judgment on what the instructions actually do. A skill can lint perfectly clean and still fail that review, because lint was never checking for the thing the review checks for.
Three auditors, one scale
Every skill in the registry is reviewed by more than one source, and every one of them reports on the same shared five-tier verdict scale, so a badge means the same thing regardless of which auditor’s page you’re reading.
The SkillMD Review is the first-party assessment. It reads a skill’s instructions directly and assigns a single verdict: is this safe to run. It’s not a stand-in for the independent tools below; it runs alongside them, so you get a direct judgment call and outside tooling looking at the same skill from a different angle.
SkillSpector, published by NVIDIA under Apache-2.0, is an open-source scanner that checks a skill against 68 vulnerability patterns across 17 categories, prompt injection, data exfiltration, privilege escalation, supply-chain risk, dangerous code caught through AST analysis, taint tracking, and YARA signature matching. It produces a 0-100 risk score and an overall severity rating.
Skill Scanner, published by Cisco’s AI Defense team under Apache-2.0, layers a different set of detection engines: signature rules written in YAML and YARA, behavioral dataflow analysis, and an optional LLM analysis pass. It reports a per-skill safe/unsafe result along with the maximum severity finding it turned up.
Two independent, open-source tools built by two different security teams, plus a first-party review, all mapped onto the same scale. You can read exactly what each one found and how its raw output maps to that shared scale on the skill’s /auditors/* page, rather than taking a single opaque badge on faith.
Why three, and why they sometimes disagree
Each auditor is built to catch a different shape of problem. Pattern and signature matching (YARA, YAML rules) is fast and precise for known-bad constructs but can miss anything novel. Dataflow and taint tracking catch a skill that documents something ordinary but actually threads data somewhere it shouldn’t go. An LLM analysis pass can catch intent that’s phrased carefully enough to dodge a pattern match but still reads, to a careful human, as clearly wrong. None of these approaches is strictly better than the others; they’re complementary, and running independent tools built by independent teams means one auditor’s blind spot isn’t automatically everyone’s blind spot.
This also means it’s normal for two auditors to land on adjacent tiers rather than an identical verdict. That’s not a bug in the system, it’s the expected outcome of two different detection methods looking at the same text through different lenses. What should get your attention is a skill where every auditor lands somewhere concerning, not one where two of three sources see the same thing and the third is one tier off.
What this means when you’re evaluating a skill
Don’t stop at the badge color. Open the skill’s auditor page and read what each source actually flagged, and against which category. A skill flagged for making an outbound network call it clearly documents and explains is a different situation from one flagged for an exfiltration pattern nobody expected from its description. The rubric on each /auditors/* page spells out exactly what each tier means for that specific auditor, so the same word, “concerning” from one source and “moderate risk” from another, maps to a comparable place on the same scale rather than requiring you to weigh two incompatible rating systems against each other.
And if you’re publishing: remember that lint passing clean is a necessary bar, not the bar. The review that actually determines your badge happens after that, reads what the skill really does, and isn’t something you can fully dry-run locally before you publish. Write the skill to be safe on its own terms, not to game a linter that was never checking for that in the first place.