cupel

  Assayed 83 extensions

  A  math-olympiad          180 tok   0% of window  +4,757 on use
  A  hook-development       136 tok   0% of window  +3,909 on use
  A  command-development    128 tok   0% of window  +4,628 on use
  A  build-mcp-app          117 tok   0% of window  +4,616 on use
  ...

  Token tax  5,758 tokens per turn  3% of your window
  On use     192,446 tokens if every extension fires
  Verdict    A

Token tax: Names and descriptions stay resident so the agent knows what it can reach for. You pay this on every single request.
On use: Skill bodies load only when invoked. This is what arrives if all of them fire in one session.
Verdict: Your worst pillar, never the average. A skill that is cheap, elegant and unsafe does not get a B.

Why this exists

Distribution arrived. Every quality gate was skipped.

Coding agents went from no extension model to eight marketplaces in eighteen months, with no verified publishers, no provenance, and no audit command.

36%

of 3,984 scanned skills carry prompt-injection flaws. Seventy six shipped with live payloads.

Snyk ToxicSkills, Feb 2026

12%

of 2,857 ClawHub skills were outright malicious.

Independent audit, 2026

1,184

skills poisoned in the ClawHavoc campaign, delivered through updates.

OWASP, Apr 2026

6.2 / 12

mean quality across 47,150 public skills. Curated sets lift agent pass rates by 16.2 points.

SkillsBench, 2026

42,000

tokens of tool schemas from one MCP server, or 21% of a 200K window.

Measured, 2026

$2.3B

in direct losses attributed to prompt injection, up 340% year over year.

Recorded Future, 2026

A verified marketplace was formally requested. Publisher identity, security review, code signing, filed as claude-code issue 30727.

Closed as not planned

Nobody is coming. Run the assay yourself.

Three pillars, one verdict.

Cost

Token weight of every tool schema and skill body, split into what you pay per turn and what waits until invocation.

Shipped

Safety

Injection patterns, hidden Unicode and homoglyphs, credential path reach, network egress, shell surface, provenance.

In progress

Quality

Structure, trigger clarity, length against usefulness, and semantic overlap with the other skills you already have.

Planned

Every scanner is blind to time.

ClawHavoc poisoned 1,184 skills through updates. The attack that actually happened is a change over time, and a stateless scanner cannot see it. cupel keeps a lockfile and reports what moved.

cupel diff

CHANGED  github-mcp  2.2.0 to 2.3.0

  + reads  ~/.aws/credentials          (new)
  + egress api.telemetry-collect.net   (new)
  ! safety  A- to D

  1 extension acquired new capabilities since your last lock.

Non-negotiable.

No network

Zero calls in the default path, enforced by a test rather than a promise.

No account, no telemetry

Credential values in your config files are never read, stored, or rendered.

Cross-platform

Existing runtime tools are Linux kernel only. This runs on your Mac.

Rules are data

Detection rules are versioned YAML with their own cases. Contribute without TypeScript.

You have never read
what your agent loads.

Seven blocks of two hundred are still yours.

One real machine, measured.