Skip to main content
A Skill is a folder with a SKILL.md: instructions, and sometimes scripts, that an AI client loads on demand. A Skill changes what the agent does, and it can come from anywhere: Anthropic, a marketplace plugin, a teammate’s repo, or an upload in the Claude app. The endpoint agent finds the Skills on each machine. Oriant scans every one and shows which are risky and who has them, on the Skills page.

Where the agent looks

Every Skill is shown with its source. The same Skill in several clones of one repo is one Skill.

How a Skill is scanned

  1. The agent sends the Skill’s name, source and a hash of its files with each device scan.
  2. If Oriant hasn’t seen that exact content before, the agent uploads the files.
  3. Oriant scans them with NVIDIA SkillSpector, statically and without an LLM.
  4. The version gets a severity and a verdict: Do not install, Caution or Safe, with each finding’s rule, category, file and line.
The same files on many machines are one Skill Version, scanned once. An edited Skill is a new version and is scanned again.

The Skills page

Skills lists every Skill in the company, worst first.
  • Scanner verdict counts the Skills marked Do not install, Caution and Safe.
  • Most exposed people shows who has the most flagged Skills.
  • The table shows each Skill’s source, severity, verdict and how many machines have it. Filter it by severity.
Skills people added are kept apart from the ones Anthropic built. Each machine’s page under Assets has a Skills tab for that machine, and Skills marked Do not install appear under Needs attention on Overview.

Review a flagged Skill

1

Open the Skill

Read its findings and its files. Reading files needs the Owner or Admin role.
2

See who has it

The Skill lists every machine that has it, and which version.
3

Remove it or ignore it

Have the Skill removed from those machines. If you’ve reviewed it and it’s fine, an Owner or Admin can Ignore that version to take it off Overview. A later edit is a new version and is scanned again.
You can also ask your AI client. Oriant MCP has a list_skills tool: “which Skills are marked do not install, and on how many machines?”

What leaves the machine

  • The files of each Skill, as a zip, once per version. Local folder paths are not sent. For a Skill in a repo, the repo’s remote (host/org/repo) is.
  • Scanning runs on Oriant’s server. The names and versions of the dependencies a Skill declares are looked up at OSV.dev. File contents are not sent to any third party.
  • Oriant deletes a version’s files 30 days after the last machine reported it. The findings stay.

Limits

  • Oriant reports a risky Skill. It doesn’t block or remove one.
  • A static scan has false positives, including on some Skills Anthropic ships. Read the finding before you act.
  • A Skill over 10 MiB is listed but not scanned.
  • Only where the endpoint agent runs. The self-hosted edition runs the MCP gateway and dashboard, so it has no Skills scanning.
Last modified on November 11, 2026