628 個 Agent 技能評分顯示，安全性幾乎無法區分優劣

We scored 628 agent skills on six dimensions. The one everyone argues about turned out to be the one that tells you least about whether a skill is good.

Every skill in our directory gets 100 points across six dimensions: trigger quality (20), structure (15), workflow design (25), content (10), engineering (10), security (20). The rubric and every per-skill rationale are public. So when people ask "how do you know a skill is good", we can actually answer with numbers.

Here is the security dimension across all 628:

Security score	Share of skills
Perfect 10	57.2%
9 or above	92.2%
Below 8	3.8%
Below 6	0.5%

More than half the directory is flawless on security. Nine in ten are within a rounding error of it. It isn't measuring a spread — it's measuring a floor almost everyone clears.

What does separate them

Split the directory three ways — top 18 (9.5+), a middle band of 214 (7.5–8.5), and the 19 below 7.0:

Dimension	Top (n=18)	Middle (n=214)	Gap
Structure	9.51	6.86	2.64
Trigger quality	9.42	7.01	2.41
Engineering	9.61	7.30	2.31
Workflow design	9.58	7.37	2.21
Content	9.67	7.52	2.15
Security	9.83	9.37	0.46

The top-vs-middle gap is 5.7× larger on structure than on security.

Then weight each gap by what the rubric actually pays:

Dimension	Raw gap	Weight	Contribution to the 1.97-point gap
Workflow design	2.21	25%	0.55
Trigger quality	2.41	20%	0.48
Structure	2.64	15%	0.40
Engineering	2.31	10%	0.23
Content	2.15	10%	0.21
Security	0.46	20%	0.09

Average top skill: 9.60. Average middle skill: 8.00. Of that 1.97-point difference, security accounts for 0.09 — about 4.6%.

Workflow design, the heaviest-weighted dimension, is the largest contributor. Trigger quality is second.

The clearest illustration

39 skills score a perfect 10 on security while scoring below 7 on structure.

Clean scripts, no suspicious network calls — and a 900-line SKILL.md with no references/ directory, no scripts/, and paths that assume the author's machine. They won't do anything malicious. They'll also struggle to do anything at all when the agent has to load them.

Security screens for catastrophe, not for quality.

The objection: why is it worth 20 points then?

Because the score isn't the only thing security controls. There's a veto: confirmed credential theft, backdoors, exfiltration, or prompt injection caps a skill at 39/100 regardless of everything else. Exactly one skill in the current directory is in that band.

So security behaves like a gate, not a ranking signal. Nearly everything published clears it, and the things that don't are removed from consideration rather than ranked low. That's a defensible design — and it's also why the dimension looks flat: censored at the top by construction, at the bottom by delisting.

If we wanted security to differentiate, we'd have to score risk surface — how much data a skill reads, how many hosts it can reach, whether it asks for capabilities it doesn't need — instead of conformance. We're not there yet. Saying so is more useful than pretending the 10s mean more than they do.

If you're choosing a skill

Don't use the security score to choose between an 8.0 and a 9.5. In that range it's telling you almost nothing. Check the capability manifest instead: what it reads, what it sends, what it persists.
Do use it as a filter. Anything in the low 7s, or flagged in the veto band, deserves a manual look before you install it.
Spend your attention on workflow design and trigger quality. Together they account for over half the difference between good and average.
Structure is the cheapest upgrade an author can make — widest spread, plenty of room for the marginal skill to improve.

Full rubric: https://skill123.me/methodology