Back to Blog AI Tools

Skills Should Be Rented, Not Owned: Introducing Skill Airlock

FixFlex Admin 31 October 2026 6 min read
Skills Should Be Rented, Not Owned: Introducing Skill Airlock

Skills Should Be Rented, Not Owned: Introducing Skill Airlock

On 30 October 2026 I recorded an unscripted Claude Code session. The prompt was one line: "Pull the tables out of report.pdf as Markdown. Pick suitable skills for this."

The agent searched a local index and came back with two candidates: the official PDF skill and a community skill called table-beautifier ("Makes Markdown tables look nicer"). The audit blocked table-beautifier, because its setup script uploads ~/.ssh to a remote server. The agent used the official PDF skill once, extracted both tables, and installed nothing.

For the record, table-beautifier is not a real published skill. It's an inert test fixture that ships in the repository, so the audit has something malicious to catch.

The important part of that session isn't the block. It's the last three words: installed nothing. The skill did its job and left. That is the whole idea behind Skill Airlock, an open-source (MIT) tool, currently in alpha:

Skills should be rented, not owned: use it, finish the task, throw it away.

The three problems

Agent skills are useful. A SKILL.md file plus a few scripts can teach Claude Code a whole workflow. But the usual way of handling them is "find it, install it, forget it", and that causes three problems.

Every installed skill costs context in every session. A skill's name and description load into the context window at startup, whether you use it that day or not. Install enough of them and you pay for all of them, every session.

You run other people's code with your permissions. A skill is instructions and scripts, and your agent acts on both, right next to your .env files, SSH keys and production config. Earlier reviews of third-party skills had already turned up some that sent data elsewhere.

Your search can leak your work. Looking at existing tools, I found that some skill-search tools can send your search query to third parties in telemetry. And a search query is usually a description of what you're working on.

How it works

Skill Airlock is a skill for Claude Code plus a small command-line tool called airlock. The agent follows a fixed order:

find → inspect → you decide → use → vent

Find. airlock sync mirrors skill catalogs from sources you list. The defaults are three public catalogs: anthropics/skills, anthropics/claude-plugins-official and vercel-labs/agent-skills, 62 skills in all. You can add your own git repositories, such as a company repo, or local folders. airlock find searches that index offline, and the agent reads the shortlisted descriptions and judges which ones fit the task.

Inspect. airlock inspect copies the candidate into a quarantine folder outside every agent's skills directory, records a sha256 hash of every file and runs a static audit. If the quarantined copy changes after inspection, Airlock refuses to use or install it.

Decide. The agent shows you what the audit found. Nothing is installed or run until you've seen it and chosen a mode.

Use. Once, for a while, or for keeps.

Vent. airlock vent removes skills that Airlock installed. Airlock never overwrites or deletes skills it didn't install.

Three ways to rent

  • once: this task only. Nothing is installed. airlock use points the agent at the quarantined copy, and no future session will load it.
  • temp: installed with an expiry, such as 7 days, and removed automatically at the start of a session once it has expired. That's the cleanup: nobody has to remember to do it.
  • keep: installed and pinned to the exact commit you inspected.

airlock dock installs from quarantine in temp or keep mode. Every installation goes into a lock file: source, commit, the sha256 of every file, mode, expiry and audit verdict. airlock verify reports any file that changed after installation, whether from an upstream update or a local edit.

Airlock installs into Claude Code and into the shared ~/.agents/skills directory used by Codex and other agents. Gemini CLI, Cursor, Copilot and OpenCode are planned, not supported yet.

The context budget

Renting only helps if you can see what owning costs. airlock budget estimates what your installed skills cost in every session, shows which ones you haven't used in the last 30 days and flags skills whose descriptions overlap. Usage comes from your local Claude Code transcripts. They're read on your machine and nothing is stored.

It answers a simple question: what am I paying for in every session, and do I still use it?

What the audit checks, and what it doesn't promise

The audit reads scripts and Markdown, because a skill's Markdown is instructions your agent will act on. It looks for network use; credential paths (~/.ssh, ~/.aws, .env, shell history, keychains, browser cookie stores, agent credentials); secrets and network use together, even split across scripts; download-and-run and decode-and-run code; persistence such as crontab, shell startup files and the agent's own settings, hooks and MCP config; destructive commands; prompt injection, including claims that the user already approved the skill; hidden content such as zero-width characters and instructions in HTML comments; remote instructions, a SKILL.md that points the agent at raw text on the network, whose content was never audited and can change; package installs in scripts; mismatches between the description and the scripts; and hygiene issues.

Every finding comes with a severity, a file:line location and a sanitised excerpt. The verdict is one of CLEAN, OK, REVIEW or BLOCK. With BLOCK, the agent recommends against the skill and goes ahead only if you explicitly override it. With remote instructions, it names the URL, says it was never audited, and summarises the content before following it.

That's evidence for you to judge, not a guarantee. The audit has already been through two independent reviews that tried hard to get past it. What they found, and what it taught us, is in Word Lists Lose: What 31 Attempts to Fool a Static Auditor Taught Us. The raw record, probe by probe, is public: docs/calibration.md.

Privacy

No telemetry, no accounts, no server. The only network traffic is airlock sync fetching the sources you listed. The search query is never stored or sent anywhere, and an automated test checks this.

Honest limits

  • The audit is static. It's a filter, not a proof. A clean report means nothing known was found, not that a skill is safe.
  • Pattern rules can always be evaded by code written to dodge them. REVIEW means "read it yourself", and the scripts of a skill from an unknown source are worth reading whatever the verdict.
  • It is not a sandbox. A skill used once still runs with your agent's permissions.
  • It is not a marketplace. It indexes the sources you choose.

Try it

You need Python 3 and git, nothing else.

git clone https://github.com/OoneBreath/skill-airlock.git
cd skill-airlock && ./install.sh
airlock sync

Then give Claude Code a task and ask it to pick suitable skills for it.

The most useful feedback right now: if you find a skill that slips past the audit, report it privately. SECURITY.md in the repo explains how.

What's next

Planned, not built yet:

  • Next: airlock update, which shows the diff and any new audit findings before applying, a trust list and blocklist (a skill with scripts from a source not on the trust list is REVIEW at least), optional sandboxed runs of a skill's bundled scripts where the operating system provides a sandbox, a decision log, and profiles.
  • Later: local "worked/failed" ratings, optionally stored in Project Brain so the agent remembers which skill worked for which task, and more agents.

That's where Skill Airlock meets its companion project. Project Brain is persistent project memory for coding agents. One remembers, the other keeps the toolbox lean.

Links

Slawomir Luzny, FixFlex Ltd

#Claude Code skills#agent skills security#SKILL.md#prompt injection#AI coding agent#context window#software supply chain