Mr. Technology indexes the open AI agent skills ecosystem, runs a four-scanner evidence pipeline over every record, and curates the subset worth your time. The scanner output is published, not hidden.
The agentic web has a quality problem. The open ecosystem has tens of thousands of “AI skill” repos. Most have not been tested. Most will not load cleanly. Some are malicious.
We don’t claim to certify anything. What we do is publish what the scanners found— source commit, scan timestamp, scanner verdict, and the explicit gaps where evidence does not exist. You decide what to ship.
The curated registry surfaces the records that are worth your evaluation time— skills that scanned cleanly, skills with documented licenses, skills whose source archive is reproducible. Everything else is in the broader index, marked with its evidence tier.
We scan a defined set of files. Records that match these formats become candidates for the curated registry. Anything outside this set is not indexed and not curated.
SKILL.md — Claude Skills Registry formatmanifest.json, tools.json, server.json, mcp.json — MCP server formatpackage.json — Node.js dependencies (Trivy-scanned for known CVEs)skill.yaml, SKILL.yaml, *.skill.md — YAML skill manifestsAGENTS.md, design.md, architecture.md, prompt.md, tool.md, README.md — agent-instruction files (when submitted through /submit-skill tagged as agent_docs)README.md in repos without other indexed files — not promoted to a curated record on its own*.py, *.ts) — security-scanned but not extracted as contentSkills that scanned cleanly and have reproducible source. The default view when you land on /registry.
Everything else, with evidence tiers. Browse, filter by verdict, see exactly what the scanner found and what it didn’t.
Operator dispatches: what I learned shipping a skill that uses these scanners, what broke, what the registry showed me about the state of the open ecosystem.
Free, inspectable workflow manifests. They are reference documents for candidate pipelines — not installers and not certification.
The scanner pipeline is open about its inputs and outputs. Every registry record carries a verdict, a scan timestamp, the source commit, and the four scanner states (gitleaks, semgrep, trivy, SkillSpector). When evidence is missing, the verdict says so. We do not average across incomplete data.
The pipeline is not a security certification. It is a reproduction layer — the same four scanners, run over the same source archive, will produce the same verdict. That is what makes the registry useful: you can re-run it on your own machine, against your own risk tolerance, and form your own judgment.
Editor: Rami Hollingsworth (editor@mr.technology), an AI Engineer and automation architect.
I built Mr. Technology as a dedicated hub for crafting the next generation of autonomous digital systems. Backed by a degree in Software Engineering and extensive experience in systems precision, my work focuses on advanced AI development, multi-agent frameworks, and automated workflows.
The scanners are real, the verdicts are reproducible, and the registry is published as-is. No certifications, no asterisks. If a record says CLEAN, it means the four scanners ran without finding anything they were configured to flag — nothing more.
For background, credentials, and prior work, see LinkedIn.