Getting Started With Research With Agent Skills: A 2026 Workflow Guide

The Skills Gold Rush Is Booby-Trapped: Why Researching Before Installing Matters

Less than a year ago, agent skills barely existed. Today, five marketplaces index more than 900,000 skills — a jump from "a handful of GitHub repos" since Anthropic published Agent Skills as an open standard in December 2025.

The growth is genuinely exciting. Skills are portable SKILL.md instruction packages that work across Claude Code, Codex, Cursor, and Gemini CLI, and they let agents tackle real tasks through progressive disclosure and bundled resources. But the same explosion created a supply-chain problem the industry is still catching up to.

The numbers are sobering. A large-scale analysis of 42,447 skills found 26.1% carry at least one vulnerability, and one campaign flooded a major registry with 1,184 malicious skills across 12 publisher accounts — at its peak, five of the seven most-downloaded skills were confirmed malware. Snyk's ToxicSkills research found 13.4% of scanned skills had critical flaws.

What makes skills uniquely dangerous is that the attack surface is language, not code. As one practitioner put it: "A malicious npm package needs to exploit a code vulnerability. A malicious SKILL.md just needs to write a convincing English sentence." Fortinet notes the barrier to publishing is a single markdown file and a week-old GitHub account — no code signing, no review process, no default sandboxing.

The documented attack patterns read like a checklist of what not to click:

• Prompt injection written in plain English inside the skill's instructions
• Base64-encoded credential exfiltration that evades naive string matching
• Dynamic payloads fetched from remote URLs at runtime
• Hidden subprocesses running under the trust context of your initial approval

Worse, scanners aren't a safety net. Snyk's own Skill Defender marked a deliberately malicious test skill "CLEAN. 0 findings," because attackers simply write the same commands differently.

This is why treating skill installation as a casual convenience choice is a mistake. Every install is a policy decision: you're granting an instruction file the ability to steer an agent that has access to your code, credentials, and tools. That's the gap SkillzBench is being built to close — a free, independent directory that verifies, scans, and benchmarks skills before they ever reach your agent, so curation happens upstream of the risk.

How Skills Actually Work (And Where the Risk Hides)

The magic of agent skills is also the danger. A skill is just a folder of instructions, scripts, and resources that your agent loads on demand — and because the instructions arrive as plain English, a malicious one "doesn't need to exploit a CVE or trigger a buffer overflow," as Fortinet puts it. It just needs to convince your agent to do something you never approved.

Anthropic designed skills around progressive disclosure: the agent reads a short SKILL.md summary first, then loads fuller instructions or bundled scripts only when the task demands them. That keeps context windows lean, but it also means the risky parts — the scripts, the shell commands, the remote fetches — stay invisible until the moment they execute. The Cloud Security Alliance calls this the "consent gap": hidden subprocesses running under the trust of your initial approval.

Documented attack vectors read like a short horror story:

• Prompt injection in plain English — instructions telling the agent to exfiltrate files or credentials, no exploit code required.
• Base64-encoded credential theft, where obfuscated commands hide what they actually do.
• Dynamic payloads fetched from remote URLs at runtime, so the file you inspected isn't the code that runs.

The scale of the problem is real. A Snyk ToxicSkills scan found 36.82% of 3,984 skills carried at least one security flaw, with 13.4% rated critical. A separate large-scale analysis of 42,447 skills found 26.1% carried at least one vulnerability, and 5.2% showed patterns suggesting outright malicious intent. One campaign even flooded a major registry with 1,184 malicious skills across 12 publisher accounts — at peak, five of the top seven most-downloaded skills were confirmed malware.

There's also a quieter cost: token overhead. An unoptimized setup consumed 50,000 tokens before the user typed a word; profile-based installation and selective loading cut that by 44%. Five "always install" skills alone add roughly 15–25K tokens per turn. Skills are only cheap if you curate them.

Because SKILL.md is now an open format that travels across Claude Code, Codex, Cursor, and Gemini CLI, the risk travels with the file, not the platform. That makes two habits non-negotiable: read the raw SKILL.md before installing (watch for curl, wget, eval, base64, and never pipe external URLs to bash), and check the allowed-tools permissions — a markdown instruction package should never need shell access. Scanners help, but they're not sufficient; Snyk's own tool marked a deliberately malicious test skill "CLEAN. 0 findings."

This is exactly the gap SkillzBench is being built to close: a free, independent directory that pins every skill to a commit SHA, security-scans and validates each one, and publishes benchmark Lift separately from trust scores — so the due diligence above is done for you before you ever install. Until then, treat every skill like a package from a stranger: inspect it, pin it, and grant it the minimum permissions it needs.

A Five-Step Vetting Workflow: From 900,000 Options to ~20 You Can Trust

With more than 900,000 agent skills indexed across five marketplaces, the real skill of 2026 isn't finding them — it's filtering them. One practitioner's disciplined five-step process cut that ocean of options down to roughly twenty trustworthy skills. As that practitioner put it, "20 is plenty."

Step one: filter by trusted publisher. Start with skills from Anthropic, Microsoft, Vercel Labs, HashiCorp, Trail of Bits, and similar established sources. The barrier to publishing a skill is, as Fortinet notes, "a single markdown file and a week-old GitHub account" — no code signing, no review process. Publisher reputation is your first and cheapest defense.

Step two: verify active maintenance. Check the repository's recent commit history and issue activity. Stale skills break silently as agent platforms evolve, and abandoned repos become targets for account takeover.

Step three: confirm it solves a real problem you actually have. A skill that merely sounds impressive adds token overhead without value — unoptimized setups have consumed 50,000 tokens before a user typed anything, per the same practitioner research. Every install should earn its context window.

Step four: read the raw SKILL.md before installing. This is the step most people skip, and it matters most. Watch for these red flags:

• Shell commands like curl, wget, or eval — especially any that pipe remote URLs into bash
• Base64-encoded blobs, a documented vector for hiding credential theft
• Over-broad allowed-tools permissions — a pure markdown skill should never need shell access
• Instructions written to persuade the agent rather than guide it

Remember: a malicious skill doesn't need a code exploit. As one researcher observed, it "just needs to write a convincing English sentence."

Step five: prefer curated directories over bulk marketplaces. One auto-indexed marketplace's 800,000 listings contain thousands of duplicates and carried a 26.1% vulnerability rate in a large-scale security analysis. Curated sources have already done the filtering that bulk indexes haven't.

One honest caveat: no single detection method is sufficient. Even dedicated scanners can be evaded — one security firm's own tool marked a deliberately malicious test skill "CLEAN. 0 findings." That's why SkillzBench is building its free directory around layered verification: pinning every version to a commit SHA, security-scanning, and sandboxed benchmarking, so the filtering work is done before you ever install. Defense in depth isn't optional in this ecosystem; it's the whole game.

From Vetting to Equipping: Building Your 2026 Skills Loadout

Knowing which skills to trust is only half the battle — the other half is running a daily practice that keeps your loadout lean, versioned, and auditable. The teams that fail at this don't fail loudly; they accumulate hundreds of installs, lose track of versions, and burn tokens on skills the agent never actually uses.

Start with an inventory. One practitioner's disciplined filter — trusted publisher, actively maintained, solves a real problem, read the raw SKILL.md first — cut 900,000+ marketplace options down to about 20, and that smaller set outperformed bulk installs on both security and cost. Pin every skill to a specific version so a silent upstream change can't alter agent behavior overnight.

Then manage your token budget with profile-based tiers rather than installing everything everywhere. The same research documented unoptimized setups consuming 50,000 tokens before the user typed anything, optimized down to 13,000 with selective installation. A sensible tiering scheme looks like:

• Core profile (~20K tokens) — a handful of always-on skills for your primary workflow
• Developer profile (~50K tokens) — adds testing, debugging, and code-review skills
• Full profile (~100K+ tokens) — everything, reserved for heavyweight sessions

Finally, treat every install as a governance decision, not a convenience. Gartner projects that more than 40% of agentic AI projects could be abandoned by 2027 without governance and ROI fundamentals — and with roughly 26% of skills carrying at least one vulnerability, ungoverned skill sprawl is exactly how that failure mode plays out.

This is where tooling earns its keep. SkillzBench is building a free directory that handles the mechanical parts of this discipline: it crawls and dedupes skills, pins every version to a commit SHA, security-scans each listing, and benchmarks every skill in a sandbox — running the same model with and without the skill and publishing the resulting Lift separately from trust scores, so a skill's measured usefulness never gets conflated with its risk profile. A free MCP connector will let you define per-agent loadouts, so each agent only sees the skills you explicitly chose for it.

Until that's live, the manual practice stands on its own: inventory, pin, tier, and review before every install. To get early access to the directory, benchmarks, and the MCP connector as they launch, join the free waitlist at skillzbench.com — everything on the platform, from scanning to alerts, will be free.