The 268 MB checkout mixes a catalog with runnable projects
The measured commit of Skill Store occupied 268 MB before its Python dependencies were installed. Inside are bundled SKILL.md packages, a crawler, static web files, finance material, an antinet-agentteams project, and several more projects under projects/. The README describes 63 local skills and 182 entries copied into an "official" index from Awesome Agent Skills. A generated section then lists 3,529 community repositories from several sources. Those are different products: some entries are links, some are instruction files, and some directories contain runnable applications.
The root SKILL.md is not a store-wide installer. At commit 47125d0 it defines a Chinese-language virtual companion for OpenClaw, grants shell, read, and write tools, and expects a Zhipu API key. To use another item, you have to identify its directory, inspect its scripts and instructions, then place it where your agent expects skills.
What happened when we ran it
Our sandbox installed the root Python requirements in 17 seconds. That added 47 packages and consumed 52 MB on disk. Pip-audit found 0 known vulnerabilities among those installed packages. The dependency file covers the updater and an optional Flask API example, including Requests, Beautiful Soup, Schedule, lxml, Flask, and Flask-Cors. This result says the root Python environment resolves cleanly. It does not cover Node packages, media tools, models, or API clients inside individual skill and project directories.
The build command failed with exit code 1 after 8 seconds. The supplied log tail contained two Python SyntaxWarnings for an invalid \E escape in antinet-agentteams video documentation scripts; both lines mention a hard-coded Windows ffmpeg location. No traceback or later causal message appears in that tail, so the finding stops there. The harness found no root test script or target and skipped tests. Its repository scan also found no tests directory, though isolated files named as tests exist inside some nested projects.
The English README covers the store, while skill operation stays Chinese-first
README_EN.md gives English readers a substantial mirror of the catalog, including the 63 local-skill list, the Python quick start, data formats, and validator commands. It is enough to understand what the repository contains. The primary README, authoring specification, validator guide, command output, and many local skill bodies are Chinese.
The Python updater is modest compared with the 63,765 source lines measured across the full checkout. main.py can fetch once, run as a daemon, show statistics, or export CSV. Its crawler reads the Awesome Agent Skills README, parses Markdown list entries, and writes structured data. A scheduled GitHub workflow updates SKILL_SOURCES.json and the main README each day. That makes the large community index current, but daily link synchronization is different from installing or retesting every repository it names.
The validator checks file shape, not whether instructions are safe
The included validator enforces a small Agent Skills format. It requires YAML frontmatter, a lowercase name, a description of at least 10 characters, at least 10 body lines, and a Markdown heading. It warns on unknown fields, version formatting, and directory-name mismatches. The quick start offers a template, then asks contributors to run the validator before opening a pull request. Those checks catch broken packaging and missing metadata. They do not execute the skill's scripts, audit requested tool access, or confirm that an external API behaves as described.
The repository had 3 CI workflow files at commit 47125d0, and none supplied a root test target to our harness. One current open request, issue 14, proposes scanning pull requests for credentials, injection, SSRF, and unsafe deserialization; its companion pull request remains open. That proposal is report-only, according to the issue. For adoption, read every chosen SKILL.md, inspect referenced scripts, list required commands and secrets, and test it in a restricted directory before giving it access to real accounts.
Conflicting license text blocks a clean bulk-adoption decision
The English and Chinese READMEs display a CC BY 4.0 badge near the top, then say "MIT License" in the license section. GitHub returned no detected repository license, and commit 47125d0 had no root LICENSE file. Several nested skills do carry their own license files, which makes a checkout-wide answer even harder. A company that wants to redistribute a bundle cannot safely infer one license from the badge or footer. Resolve provenance for each selected skill and its assets before copying it into an internal catalog.
GitHub showed 6,444 stars, 6 open issues, 8 open pull requests, and a last push on September 9, 2026. Several recent commits came from daily synchronization bots, while the same day also included manual README edits. The project is active, but the open queue contains skill submissions, promotional spam, and pull requests dating back to April. There is no GitHub release listed. That pattern suits a living collection better than a versioned software product with a tested upgrade path.
Use the catalog to discover one skill, then review that skill alone
Skill Store earns a bookmark for Chinese-speaking builders because its local collection covers jobs that English-only lists often miss. Its 1,008-file measured repository is a poor unit of adoption, however. Start at the English or Chinese index, follow the original source, compare the bundled copy, and install only the directory you need. Awesome Agent Skills is a cleaner starting point for broad discovery. Anthropic Skills and OpenAI Skills narrow the choice to examples tied to their respective agent ecosystems.
The build failure, missing root tests, Windows paths, and license conflict keep Skill Store out of a trusted base image. None of those findings erase the value of a good individual skill. They change the buying decision: this is a lead list with some bundled material, not one verified package. Treat every skill as a separate dependency, record its source commit and license, and grant only the tools its stated job requires.