Are awesome-list Skills Safe to Install?

The Skills Boom Nobody Vetted

The skills ecosystem grew from a quiet experiment into a gold rush in a matter of weeks. Daily submissions to public skill repositories jumped from under 50 in mid-January 2026 to more than 500 by early February, a tenfold surge that overwhelmed any hope of manual review, according to Snyk's audit of nearly 4,000 skills.

Scale alone tells the story. ClawHub held over 70,000 skills by June 2026, while the OpenClaw framework collected more than 370,000 GitHub stars in under six months, per HiddenLayer's supply chain research. Malicious skills appeared in the wild just two months after launch, long before most users had heard the term "agent skill."

The risk is not theoretical. An empirical study of 31,132 skills found that 26.1% carry at least one vulnerability, spanning prompt injection, data exfiltration, privilege escalation, and supply chain exposure. Snyk's separate audit found 76 confirmed malicious payloads, with eight malicious skills still publicly available at publication.

Why does this matter so much? Skills are not passive prompts. They inherit the full permissions of the agent running them:

• Shell access and file system read/write
• Credentials stored in environment variables and config files
• Messaging ability across email, Slack, and WhatsApp
• Persistent memory that survives across sessions

Publishing requires only a SKILL.md file and a GitHub account one week old, with no code signing, no security review, and no sandbox by default. That combination makes popularity a poor proxy for safety, because install counts and upvotes have been gamed through scripted requests and bot activity.

The lesson is uncomfortable but simple: treat every skill as untrusted code, regardless of how many stars it has. This is the gap SkillzBench is being built to close, through commit-SHA version pinning, security scanning, sandboxed benchmarking, and per-agent loadouts that limit what an agent can see.

What the Security Audits Actually Found

The numbers are in, and they are not reassuring. Independent security audits of the agent-skills ecosystem reveal that roughly one in four to one in three publicly available skills carries at least one vulnerability — and some are outright malicious.

The largest empirical study to date, an academic analysis of 31,132 skills collected from public marketplaces, found that 26.1% of skills contain at least one vulnerability across 14 distinct risk patterns spanning prompt injection, data exfiltration, privilege escalation, and supply-chain risks. Data exfiltration appeared in 13.3% of skills, and privilege escalation in 11.8%.

Snyk's audit of nearly 4,000 skills from ClawHub and skills.sh tells a similar story from a different angle: 13.4% of skills contained at least one critical issue, and 36.82% had at least one security problem of any severity. The audit also confirmed 76 malicious payloads in the wild — including the first documented coordinated malware campaign targeting Claude Code and OpenClaw users, distributed through more than 30 malicious skills. The two studies differ in thresholds, not conclusions: the risk rate is material by any measure.

Perhaps most striking is how these malicious skills work. Snyk found that 100% of confirmed malicious skills contained malicious code patterns, while 91% simultaneously used prompt injection to prime the agent into accepting and executing that code. The natural-language layer of a SKILL.md file can quietly talk an agent into trusting the malicious script bundled alongside it — a combination traditional malware scanners are poorly equipped to catch.

Why skills are riskier than npm or PyPI packages:

• Skills inherit the agent's full permissions — shell access, file read/write, credentials in environment variables, and messaging channels like email and Slack, as HiddenLayer's research explains.
• Publishing requires only a SKILL.md file and a GitHub account one week old. No code signing. No security review. No sandbox by default.
• A "consent gap" means users approve a skill once, then it retains persistent permissions — reading files, downloading code, and opening network connections — without further prompts.
• Skills are not cryptographically signed, so agents execute whatever instructions they contain with no inherent verification.

A typical npm package, by contrast, runs in a constrained environment and rarely holds your credentials by default. As Snyk put it, the current landscape resembles early package managers before security became a first-class concern — except skills arrive pre-wired with far more dangerous capabilities.

This is exactly the gap SkillzBench is being built to close: pinning every skill version to a commit SHA, security-scanning before anything reaches your agent, and sandboxed benchmarking so you can see what a skill actually does before trusting it with your environment.

How Trust Signals Get Gamed

The most dangerous skills on a marketplace often look like the safest ones. Attackers don't need to break anything — they just need to make a malicious skill appear popular, and the distribution platforms make that trivially easy.

Orca Security demonstrated this in a prominent skills marketplace with four attack primitives, all of which achieved real code execution on end-user systems in end-to-end tests. Install counts could be inflated with unauthenticated requests, meaning a script can manufacture "10,000 installs" overnight. Scanning was non-deterministic, running only at creation and at a popularity threshold — leaving windows of days or weeks where malicious content sits unexamined.

Worse, two structural flaws let attackers weaponize the update path itself:

• Silent overrides on name collisions — installing a skill with the same name as an existing one can silently replace it, regardless of source.
• Blind bulk updates — update mechanisms refresh all installed skills at once, with no diffs or changelogs, enabling delayed weaponization of a skill you already vetted.
• No version pinning, so the "safe" skill you reviewed last week can become something else entirely this week.

Mitiga Labs proved how far this goes. Their proof-of-concept skill, "Testing-Validator," silently exfiltrated an entire local codebase to an attacker's public GitHub repo — requiring only four user interactions and leaving the audit log completely empty. The attack chain included bots upvoting the skill and fake accounts mass-downloading it to inflate trust. Their conclusion is blunt: "Don't trust skills based on 'Stars' or 'Upvotes.'"

The scale makes gaming profitable. Snyk's audit of 3,984 skills found daily submissions jumped from under 50 to over 500 in a matter of weeks, with 76 confirmed malicious payloads and a coordinated campaign of 30+ malicious skills. When thousands of new skills arrive weekly, popularity metrics measure marketing effort, not safety.

This is why stars, upvotes, and download counts are worthless as security signals — they can be manufactured for the cost of a few bot accounts. Genuine safety requires verification at the artifact level: pinning each version to a specific commit, scanning for behavioral compromise, and reviewing what actually changed between versions. That's the approach SkillzBench is building into its free directory, where every skill version is pinned to a commit SHA and re-scanned when upstream changes — because a number next to a download button tells you nothing about what's inside the package.

A Practical Vetting Checklist Before You Install

The research consensus is blunt: skills are code, not prompts. The Orca Security team put it plainly — treat every skill as untrusted code, because that's exactly what it is. With roughly 26% of skills carrying at least one vulnerability, a short vetting routine before each install is the difference between a helpful agent and a compromised one.

Start with the instructions themselves. Read the full SKILL.md before granting any permissions, and watch for two red flags: silencing language (instructions that tell the agent to hide what it's doing or skip logging) and allowlist instructions (rules that quietly expand what the agent may touch). A Mitiga Labs proof-of-concept skill exfiltrated an entire local codebase to an attacker's GitHub repo in just four user interactions, leaving the audit log completely empty — the kind of behavior you can only catch by reading instructions first.

Next, weight the risk profile. Be at least twice as wary of skills that bundle executable scripts: an empirical study of 31,132 skills found script-bundling skills are 2.12× more likely to contain vulnerabilities than instruction-only ones. If a skill ships scripts, read them line by line, or skip it entirely.

Then lock in what you installed:

• Pin every skill to a commit SHA, not a floating version, so upstream changes can't reach your agent without your review.
• Avoid blind bulk updates. Orca Security showed update mechanisms refresh all skills at once with no diffs or changelogs, enabling delayed weaponization — review each skill's changes individually.
• Treat name collisions as hostile. Installing a skill with the same name as an existing one can silently replace it regardless of source.
• Remove unused skills promptly and monitor installed ones for behavioral drift over time.

Finally, don't lean on vendor defaults. Even Claude's built-in scanning has candid coverage gaps: it doesn't scan skills shared through connected MCP servers, MCP servers and hooks, pre-existing skills, or skills created with Claude — and even a pass "isn't a guarantee that a skill is safe in every respect." A clean scan is a starting point, not a safety certificate.

This is the gap SkillzBench (skillzbench.com) is being built to close: commit-SHA version pinning, security scanning, license checks, and sandboxed benchmarking for every skill, plus per-agent loadouts where your agent only sees the skills and tools you explicitly chose. Everything is free, and the waitlist is live if you want skills vetted before they ever touch your agent.

Vetted Skills and Independent Benchmarks: What SkillzBench Is Building

The individual checklist from earlier sections helps you today, but the deeper problem is structural: skills gain full agent permissions with no verification step anywhere in the pipeline. Publishing one requires nothing more than a SKILL.md file and a week-old GitHub account — no code signing, no security review, no sandbox by default, as Snyk's audit put it. That's why the arXiv study of 31,132 skills concluded there's an "urgent need for capability-based permission systems and mandatory security vetting" before attackers exploit this vector further.

OWASP has moved in the same direction with its Agentic Skills Top 10 (AST10), the first comprehensive security framework for agent skills, documenting the most critical risks across major platforms with evidence-based mitigations. But frameworks and checklists still leave the heavy lifting to each user. What's missing is infrastructure that does the vetting work once, transparently, and lets everyone benefit.

That's the gap SkillzBench is building to close. It's a free, independent directory of AI agent skills — the SKILL.md instruction packages used by Claude Code, Codex, Cursor, Gemini CLI and chat-app agents — paired with a free MCP tool that connects any agent to the skills you choose. The design maps directly onto what researchers are calling for:

• Commit-SHA pinning on every skill version, countering the blind bulk-update problem Orca Security demonstrated, where update mechanisms refresh skills with no diffs or version review.
• Security scanning and validation on every listing, including license checks and quality judging — the mandatory vetting layer the arXiv study says the ecosystem lacks.
• Sandboxed benchmarking: each skill is tested with the same model, with and without the skill, and the Lift in percentage points is published separately from ratings.
• Per-agent loadouts: you toggle skills and tools for each agent, and the agent only ever sees what you explicitly chose — a practical answer to the "consent gap" where users approve entire skills without reviewing capabilities.
• Continuous monitoring that tracks upstream changes, re-scans and re-benchmarks, and notifies you — because a skill that was clean at install time can be weaponized later.

Every listing carries a trust score from 0 to 100 built from security, quality, license, maintenance and community signals. Lift is always shown separately, and money never touches the scores. The whole platform — directory, MCP connector, benchmarks and alerts — is free; revenue comes from ads around blog articles, never from users.

Two caveats worth stating plainly. First, SkillzBench is pre-launch: the waitlist is live, but the scanning, benchmarking and MCP tooling are still being built, and no benchmark results are published yet. Second, no directory — curated or not — replaces your judgment. Researchers at Mitiga Labs warn against trusting stars or upvotes, since both have been gamed with bots and fake downloads, and a curated list is only as good as its vetting process.

But the direction of travel is clear. The skills ecosystem resembles early package managers before security became a first-class concern, and the community now has a chance to build the verification layer it should have had from day one. If you want to follow that build as it happens, the waitlist at skillzbench.com is the place to sign up.