fires when
Use this skill when the user asks what skills exist in this marketplace, what could help with a task, to recommend or install a skill, or to browse the catalog — e.g. \"what skills are available for writing tests?\", \"recommend a skill for reviewing my SCSS\", \"install the skill that formats commit messages\", \"show me everything in this marketplace\". This skill is PASSIVE — it never runs code; it is instructions telling the agent to read the bundled catalog.json and act on it. NOT for authoring a brand-new skill (`meta:new-skill`), NOT for refreshing an existing skill's metadata.yaml (`meta:update-skill`), and NOT for ordinary unrelated coding tasks.
best for
Any session where the user wants to browse what skills exist, get a fit recommendation for a task, or install a skill from this marketplace.
measured · trigger
best score
11/12
description-triggering measured 2026-09-07
measured · quality
Not measured yet. A quality number needs its own eval: 15 or more tasks, each run with the skill and without it.
security scan · 8/8
✓prompt-injectionSKILL.md explicitly instructs treating catalog fields as untrusted data, never as instructions to obey.
✓data-exfiltrationNo network calls; skill only reads local catalog.json and renders tables to the user.
✓secret-detectionNo embedded keys/tokens found in SKILL.md or catalog.json.
✓dangerous-commandsNo scripts/ dir at all; only doc-mentioned example commands like /plugin install, none executed by the skill itself.
✓obfuscationPlain markdown instructions and JSON catalog data, nothing encoded or eval'd.
✓external-fetchesNo fetch/curl/download logic present; skill is purely local read-and-render.
✓credential-accessNo references to ~/.ssh, ~/.aws, .env, or keychain anywhere in the material.
✓privilege-escalationNo sudo/setuid/cron/profile edits; only in-session /plugin install command, user-confirmed.
scanned 2026-09-10 · cerberus:security-scan
side effects & deps
read-onlyhook
needsnothing
what’s inside
SKILL.md12.6 KB
catalog.json81.6 KB
metadata.yaml496 B
evals/result.json5.1 KB
evals/rubric.json1.9 KB