Build an Agent Skill that checks license, provenance and side effects before use
A new SkillMD registry count illustrates an avoidable weakness in reusable agent instructions: provenance and permissions are often invisible to the person or agent copying them. The site's October 10 query found that 901,653 of 1,081,266 indexed public SKILL.md files—83.4%—lacked a populated license field in their own frontmatter. That figure measures one metadata field in one indexed population, not the proportion of skills that are legally unlicensed. The survey deliberately did not inspect repository-level LICENSE files, which may grant rights even when frontmatter is blank. Where license strings were present, authors used inconsistent free-text forms such as Apache 2.0 versus Apache-2.0, complicating automated policy checks. Turn this observation into a practical Agent Skill named third-party-skill-intake. Its trigger is 'review this external SKILL.md before our team uses it.' Require the exact source URL and pinned commit; read the complete SKILL.md and associated scripts; inspect frontmatter license and the containing repository's LICENSE; normalize only recognizable SPDX identifiers and mark ambiguous permissions for legal review; enumerate network, filesystem, credential and command side effects; simulate or manually review with all external writes disabled; request approval from a named owner; finally output an intake record with source commit, observed permission terms, tool/secret scope, unresolved risks, test result and an explicit adopt/reject decision. Never execute the candidate skill merely to inspect it.
Build an Agent Skill that checks license, provenance and side effects before use
Focus: Agents for Everyone Date: October 10, 2026 Topics: Agent Skills, license metadata, provenance, supply chain review, safe adoption Evidence: Publisher Authored Availability: Available
Summary: A new SkillMD registry count illustrates an avoidable weakness in reusable agent instructions: provenance and permissions are often invisible to the person or agent copying them. The site's October 10 query found that 901,653 of 1,081,266 indexed public SKILL.md files—83.4%—lacked a populated license field in their own frontmatter. That figure measures one metadata field in one indexed population, not the proportion of skills that are legally unlicensed. The survey deliberately did not inspect repository-level LICENSE files, which may grant rights even when frontmatter is blank. Where license strings were present, authors used inconsistent free-text forms such as Apache 2.0 versus Apache-2.0, complicating automated policy checks. Turn this observation into a practical Agent Skill named third-party-skill-intake. Its trigger is 'review this external SKILL.md before our team uses it.' Require the exact source URL and pinned commit; read the complete SKILL.md and associated scripts; inspect frontmatter license and the containing repository's LICENSE; normalize only recognizable SPDX identifiers and mark ambiguous permissions for legal review; enumerate network, filesystem, credential and command side effects; simulate or manually review with all external writes disabled; request approval from a named owner; finally output an intake record with source commit, observed permission terms, tool/secret scope, unresolved risks, test result and an explicit adopt/reject decision. Never execute the candidate skill merely to inspect it.
Why it matters: A skill is operational instruction, not harmless reference text. Copying it into a workspace can silently expand an agent's behaviors and create intellectual-property or security exposure. The reusable intake procedure is lightweight enough for a non-developer to follow: pin provenance, inspect declared rights, identify the actual executable capabilities, keep permissions off by default and require a sign-off before installation. A missing frontmatter field alone must never be misreported as definitive lack of a repository license.
