Check what an agent skill needs before you install it: 3,134 skills want an account or key

Before you install an agent skill, read its SKILL.md frontmatter and body for environment variables, CLIs and sign-in steps, then open every file it links to. In our census of 2026-10-30, 3,134 of the 16,798 skills with a stored prerequisite list (18.7%) named an account, login or API key. An empty list proves nothing.

Data as of 2026-10-30, from the Skillselion Agent Skill Dependency Census. Disclosure: we run Skillselion, and this is our own catalog data. We are not affiliated with any publisher named below.

A skill install is one command. The sign-up that the skill expects is often a separate step, and you often find out about it when the agent stops halfway through a task and asks you for a token. You can find out before you install.

How many agent skills need an account or API key?

On 2026-10-30 we read the prerequisite list that our catalog stores for each skill. 16,798 of 64,756 skills (25.9%) have one. All the shares below use those 16,798 skills as the denominator, never the full catalog.

• 3,134 skills (18.7%) name an account, API key, access token, credential, login, subscription or secret.
• They come from 600 publishing accounts, so the requirement is spread across many publishers.
• They hold 16.9% of installs on skills that list prerequisites. Installs are registry counts, and a suite installed as a bundle records one install per skill, so that share can overstate distinct installs.

The share moves a lot by category. Among the 14 categories with at least 500 skills that list prerequisites, it is highest in automation and workflow skills (395 of 955, 41.4%) and lowest in Documentation (17 of 595, 2.9%). Our reading, which the census does not test: automation skills tend to call someone else's API, and docs skills mostly work on files already in your repo.

Two entries the census quotes show the typical shape: "Deepgram API key" and "Auth0 account and application". Each one points to a third-party sign-up or key you need before the skill can do its job.

What kinds of accounts do skills ask for?

We picked six skills from the catalog, read the prerequisite list we store for each (fetched 2026-11-02), and then read the upstream SKILL.md at a pinned commit. The two do not always say the same thing, and the SKILL.md wins.

The ElevenLabs file is the clean case. The requirement sits in the frontmatter, where a script or a reviewer can find it in one line:

compatibility: Requires internet access and an ElevenLabs API key (ELEVENLABS_API_KEY).

Source: text-to-speech/SKILL.md, frontmatter

The Google Workspace Gmail skill is the case that catches people. Its own file only says it needs the gws binary. The auth step is one hop away:

Read ../gws-shared/SKILL.md for auth, global flags, and security rules.

Source: skills/gws-gmail/SKILL.md, "PREREQUISITE"

Open the gws-shared reference skill and you get the two options: gws auth login for browser OAuth, or a service account through GOOGLE_APPLICATION_CREDENTIALS (lines 23 and 26). If you only read the Gmail skill, you miss that choice, and the two options hand an agent different kinds of access.

The Notion skill shows what happens when the key is missing. Its fallback is to ask you in the chat:

If neither is available, use AskUserQuestion (or equivalent) to request the API key from the user

Source: skills/notion-api/SKILL.md, "Authentication"

That is a reasonable design. It also means a token can end up pasted into a conversation transcript if you have not set NOTION_API_TOKEN in the environment first. Decide where the key lives before the agent asks.

Why can't you trust an empty prerequisite list?

Three reasons, all from the census methodology.

First, the lists are model-written. A language model writes them while reading each skill's SKILL.md. They are a reading of the docs, not a parsed manifest. The hyperframes-cli row above is a fair example: the list says Node.js and FFmpeg, which matches the line "It needs Node.js 22+ and FFmpeg." (source), and it leaves out the cloud auth path the same file routes to references/cloud.md.

Second, most skills have no list at all. 47,958 skills have no entry stored. The census says it plainly: an empty list is not evidence either way.

Third, the keyword rule misses and over-matches. "Account size and sizing constraints" lands in the account class, and a key described in other words is missed. The census methodology section lists every pattern.

Coverage also leans toward popular skills: the median skill with a list has 761.5 installs, the median skill without one has 48. If you install long-tail skills, you are more likely to be looking at a skill with no list.

How do you check a skill before you install it?

Run these in order. Each skill takes a few minutes.

1. Read the frontmatter. Look for compatibility:, requires: (often env: and bins:), and allowed-tools:. When a publisher declares an env var or binary, this is where it goes.
2. Search the body for credential names and sign-in verbs. *_API_KEY, *_TOKEN, *_SECRET, "API key", "OAuth", "login", "credentials".
3. Follow every relative link. ../shared/SKILL.md, rules/install.md, references/*.md. The gws-gmail auth step is one link away, and the Firecrawl skill sends install and authentication (including what it calls "the keyless free tier") to rules/install.md.
4. List the binaries and servers it calls. A skill that shells out to a vendor CLI or talks to an MCP server (see the Skillselion MCP server directory) inherits that tool's login. github-issues needs whatever auth your GitHub MCP server or gh has.
5. Decide where the key lives and what scope it has. A project .env, a shell profile, a CLI's own credential store. Use the narrowest token the service offers.
6. Check for a status or dry-run command. Firecrawl's skill says firecrawl --status "shows auth state, concurrency limit, and remaining credits" (source). Run that before the agent does.

Steps 1 and 2, plus every file inside the skill's own folder, fit in a sparse clone and two greps, with nothing installed:

# fetch one skill folder, install nothing
git clone --depth 1 --filter=blob:none --sparse https://github.com/elevenlabs/skills
cd skills && git sparse-checkout set text-to-speech

# credentials and sign-in steps
grep -rnE '[A-Z][A-Z0-9_]*_(KEY|TOKEN|SECRET)\b|[Aa][Pp][Ii] key|OAuth|log ?in|sign(s|ed)? (in|up)|credential' text-to-speech/

# runtimes, binaries, declared requirements
grep -rnE '^(compatibility|allowed-tools|metadata):|requires|npx |pip install|brew install|Node\.js|ffmpeg' text-to-speech/

We ran this on the ElevenLabs folder on 2026-11-02. ELEVENLABS_API_KEY shows up on 16 lines across four files: the SKILL.md and three reference files. The second grep surfaces three install routes (npm, Homebrew and pip) from references/installation.md, which the SKILL.md itself only links to. Swap the repo and folder name for any other skill.

What does this checklist not catch?

It tells you what a skill needs. It does not tell you what the skill costs or what it is allowed to touch.

For cost, the Agent Skill Pricing Census covers which skills need your own key and which keys they name. It reads a different field from this census, so the two shares measure different things. For shell and file permissions, see the Agent Skill Security Census.

It also misses scripts. If a skill bundles a Python or shell script, read the script too. A grep on the markdown will not show what a bundled setup script exports.

FAQ

Do most agent skills need an API key?
No. On 2026-10-30, 18.7% of the 16,798 skills with a stored prerequisite list named an account, login or API key. The other 47,958 skills in the catalog have no list stored, which is not evidence that they need nothing.

Where does a skill declare its required env vars?
When the publisher declares them, look in the SKILL.md frontmatter (compatibility: or a requires: block with env:), then in the body and in any linked reference file. Some skills put auth in a shared sibling file.

Is the census prerequisite list complete?
No. A model writes it from the SKILL.md text and keeps it short, so it can be incomplete or worded loosely. Treat it as a pointer to what you verify in the upstream file.

What should I do if a skill asks me to paste a key into the chat?
Stop, set the key as an environment variable or in the tool's own credential store, and rerun. That keeps it out of the conversation transcript.

The category breakdown is in the census finding on accounts and API keys. For live catalog totals, see The State of AI Agent Skills 2026. The catalog is refreshed daily from skills.sh, GitHub and MCP registries, ranked by real installs.