GitHub repo bundles 1,900 agent skills without scanning

A GitHub repository packages more than 1,900 installable skills for Claude Code, Cursor, Codex CLI, Gemini CLI, and Antigravity, per the repo. It has pulled in roughly 42,800 stars, which makes it a default stop for equipping agents with new capabilities. None of the 1,900 skills carry a signature, a lockfile, or a scan step before they land on your machine.

The scale showed up days after Cisco open-sourced skill-scanner and shipped it into an IDE extension, which the listing calls no coincidence. A tool built for this exact gap arrived right as the gap hit its biggest target yet.

Package management already went through this problem, and lockfiles, signatures, and audit tooling were the fix, per the listing's own framing. Skills installed through curated bundles have none of that machinery in place yet.

Scan before you install

Cisco's skill-scanner does the check this registry skips, and skipping it while sitting at 42,800 stars is the risky combination. If you're pulling skills from here, run the scanner against a bundle before you install it, not after.