tools-only Remote Skills Analysis: Do Remote Skills Exist?
Executive Summary
Finding: No, remote Agent Skills do not exist. Agent Skills are local packages that users install on their machines, not remote services like MCP servers.
Evidence from Codebase
1. Explicit Documentation
From skill_scanner/data/prompts/code_alignment_threat_analysis_prompt.md:
**Key Point**: Skills are **local packages** that agents load, not remote servers!
2. Skill Distribution Model
From the codebase analysis:
- Skills are distributed as: ZIP files or local directories
- Installation: Users download and install skills locally
- Structure: Local folder with
SKILL.mdfile - Usage: Agent reads from local file system
3. Skill Loading Process
From skill_scanner/core/loader.py:
class SkillLoader:
"""Loads and parses Agent Skill packages.
Skills are structured as:
- SKILL.md (required): YAML frontmatter + Markdown instructions
- scripts/ (optional): Executable code (Python, Bash)
- references/ (optional): Documentation and data files
- assets/ (optional): Templates, images, and other resources
"""
The loader expects a local directory path, not a remote URL.
4. How Agents Use Skills
From the prompt documentation:
- Discovery: User installs skill package locally
- Loading: Agent reads SKILL.md manifest from local file system
- Activation: Agent loads instructions from local files
- Execution: Agent runs scripts from local directory
- Output: Agent uses skill results to respond to user
No remote access involved.
Comparison: MCP Servers vs Agent Skills
MCP Servers (Remote)
- ✅ Are remote: HTTP/SSE/stdio connections
- ✅ Require API scanning: Need to scan remote endpoints
- ✅ Network-based: Accessible via URLs
- ✅ API server essential: Must connect to remote servers
Agent Skills (Local)
- ❌ Not remote: Local file packages
- ❌ No remote API: No remote skill endpoints exist
- ❌ File-based: Accessed via file system paths
- ⚠️ API server optional: Only for integration workflows (upload ZIPs)
Web Search Results
Searches for "remote Agent Skills" or "Agent Skills API" return:
- MCP server results: All results are about MCP servers (which ARE remote)
- No Agent Skills remote access: No evidence of remote skill hosting
- No skill marketplace API: No public API for accessing remote skills
Conclusion: The web search confirms that remote skills don't exist - only MCP servers are remote.
Why API Server Still Exists
The API server in Skill Scanner is NOT for scanning remote skills (they don't exist). Instead, it's for:
1. CI/CD Integration
- Upload skill ZIP files via HTTP
- Integrate with build systems (GitHub Actions, GitLab CI)
- Store scan results as artifacts
2. Web-Based Interfaces
- Upload skill packages via web UI
- Batch scanning through web dashboard
- Result visualization in browser
3. Service Integration
- Other services calling scanner via HTTP
- Microservices architecture
- Load balancing multiple scanner instances
4. Batch Processing
- Async scanning of multiple local skills
- Job management via API
- Progress tracking
Key Difference from MCP Scanner
| Feature | MCP Scanner | Skill Scanner |
|---|---|---|
| Target | Remote MCP servers | Local skill packages |
| Access Method | HTTP/SSE/stdio | File system paths |
| API Necessity | Essential (must connect to remote) | Optional (for integrations) |
| Primary Use Case | Scan external services | Scan local files |
| API Purpose | Connect to remote servers | Upload/process ZIP files |
Recommendation
Keep API Server (But Clarify Purpose)
Rationale:
- Not for remote skills: Skills are local, no remote scanning needed
- For integrations: Useful for CI/CD, web interfaces, batch processing
- Upload workflow: Enables uploading ZIP files via HTTP
- Optional feature: CLI is primary interface
Documentation Updates Needed
Update documentation to clarify:
- ❌ Remove: Any mention of "scanning remote skills"
- ✅ Add: "API server enables uploading skill ZIP files for scanning"
- ✅ Emphasize: Skills are local packages, not remote services
- ✅ Clarify: API is for integration workflows, not remote access
Conclusion
Remote Agent Skills do not exist. Skills are local packages installed on users' machines. The API server is valuable for integration workflows (CI/CD, web interfaces, batch processing) but is not for scanning remote skills, as they don't exist.
The API server should be positioned as:
- Optional integration feature
- For uploading and processing skill ZIP files
- For CI/CD and web-based workflows
- Not for remote skill access (skills are local)