SkillGrade TRUST GRADES FOR CLAUDE CODE SKILLS

AUTOMATED EVALUATION · EVIDENCE ATTACHED

Every grade comes with evidence.

SkillGrade automatically evaluates Claude Code skills across security, quality and hygiene — and shows the concrete check verdicts behind every letter, so trust is auditable, not magic.

Browse skills How we grade Audit your skills via MCP →

NEW · MCP SERVER · mcp.skillgrade.dev

Audit your installed skills — right from your agent.

Connect the SkillGrade MCP to Claude Code and ask it to check the skills you already have. It matches each SKILL.md against our graded catalog by content hash — so you see the grade, whether your copy drifted from the one we graded, and lightweight notes on what to fix.

Read-only and privacy-first: only a skill's name and a hash ever leave your machine — never the skill's contents. The server runs nothing you send it.

1 · ADD THE SERVER

claude mcp add --transport http skillgrade https://mcp.skillgrade.dev/mcp

2 · ASK YOUR AGENT

“Check the skills in ~/.claude/skills against SkillGrade — which are safe, which drifted, and what should I fix?”

lookup_skill

One skill by hash or name → grade + findings.

audit_skills

Your whole set at once → summary + per-skill verdicts.

search

Find a graded skill by name.

Status — verified: your copy matches ours · drift: yours differs, we can’t vouch for it · reference: graded, send a hash to confirm · unknown: not in the catalog yet.

HOW WE GRADE

Three dimensions. One letter each.

A deterministic pre-check layer gathers facts — file counts, frontmatter, flagged patterns — then a model evaluation grades each dimension against the rubric. The overall grade is simply the worst graded dimension, so one letter can never hide another.

Not evaluated is not a bad grade. A dash means missing data — it is never colored red or green.

F means rejected. Usually a critical security finding; it is information, not punishment.

THE ALGORITHM

No black box. The whole method, in the open.

Trust you can’t inspect is just branding. So here is exactly how every letter on this site gets made: the same six steps for each skill, whoever wrote it.

01

Deterministic pre-checks

Before any model runs, code measures the facts: frontmatter validity, file count, size, flagged patterns.

02

The skill is data, never instructions

Its SKILL.md is evaluated as untrusted content, wrapped so nothing inside it can steer the grader. That’s the same injection-resistance we grade skills for.

03

Thirty checks, three dimensions

Security (12), Quality (10) and Hygiene (8), from a versioned rubric. A calibrated model rules each check pass, fail, warning or n/a, and points at the evidence.

04

Scores are computed in code

The model never assigns a letter. Each dimension’s checks aggregate to A–F in code, so a grade can’t be hallucinated or nudged.

05

Overall is the worst dimension

One letter can never hide another. An F marks a critical finding, usually security. Read it as a pointer to what to check.

06

Calibrated, vetted graders

We grade with frontier models we keep re-testing (Claude Sonnet and Gemini 2.5 Flash), and disqualify any that false-positive or bend under manipulation. Each skill’s grade names the model that made it.

Browse skills

MIN GRADE
SORT