License Risks in Agent Skills: What Teams Miss

Skills Are Software — And Nobody Is Checking Licenses

Agent skills look like prompts, but vendors treat them like software — and that distinction changes everything about the risks they carry. Anthropic's own documentation describes skills as "filesystem-based resources" containing instructions, executable scripts, and reference materials, and advises teams to treat them like installing software.

The numbers back that framing. A large-scale academic analysis of 31,132 published agent skills found that 26.1% contain at least one vulnerability, with skills bundling executable scripts 2.12x more likely to be vulnerable than instruction-only skills. Roughly 5.2% showed high-severity patterns strongly suggesting malicious intent — about 1,600 skills in circulation.

A scanning category is emerging to meet this risk, but it is entirely security-shaped:

• CertiK's Skill Scanner — "antivirus software for the AI age" — scores skills 0–100 across hidden malicious behavior, unauthorized data access, and autonomous execution risks. Licensing is not mentioned.
• NVIDIA's SkillSpector — an open-source static scanner covering 71 vulnerability patterns in 17 categories across Claude Code, Codex CLI, and Gemini CLI. Again, no license analysis.
• Both tools answer "is this skill safe to run?" — neither answers "am I allowed to use what's inside it?"

That second question is not hypothetical. Black Duck's OSSRA audit data found that 53% of audited codebases contained open source with license conflicts, and Creative Commons ShareAlike licenses alone produced 33% of all conflicts found. Skills are frequently assembled from copied snippets, bundled scripts, and AI-generated code — the exact channels through which license obligations travel.

The legal exposure is real, too. A Northern District of California court allowed a breach-of-open-source-license claim against GitHub Copilot to partially proceed, establishing that AI-assisted code can carry genuine license liability when attribution and license terms are ignored.

SkillzBench is being built on the premise that verification has to cover both pillars — security and licensing — not just one. Its Verify pillar will license-check every skill alongside security scanning and quality judgment, because a trust score that ignores licensing is only half a trust score.

The market has decided skills are software. It just hasn't started checking what software teams have checked for decades: where the code came from, and under what terms.

The Four License Risks Hidden Inside Every Skill

Most teams vet agent skills for security and never ask a simpler question: what license is this thing under? Yet the same code that makes skills useful carries obligations that don't disappear because it was pasted into a SKILL.md file. Here are the four license risks hiding inside almost every skill.

Risk 1: Copied snippets inherit their original licenses. Skills are frequently assembled from code lifted from Stack Overflow and other public sources, and that code doesn't arrive unencumbered. According to Black Duck's OSSRA audit data, 53% of audited codebases contained open source with license conflicts — and CC-SA licenses alone, the family covering Stack Overflow's public contributions, produced 33% of all conflicts found. ShareAlike terms can have a viral effect similar to the GPL, quietly propagating obligations into any skill that bundles them.

Risk 2: "Permissive" doesn't mean "safe." License compatibility is directional: Apache 2 code can flow into GPLv3 projects, but GPLv3 code cannot flow into Apache projects. Teams that check for a permissive license label and stop there miss both directionality and edge cases. The JSON license, for instance, is MIT-based but adds the requirement that the software "be used for good, not evil" — a clause Black Duck notes leaves its meaning up to interpretation and adds risk.

Risk 3: Deployment model and hidden dependencies change everything. The same dependency carries different compliance obligations depending on whether you run it as SaaS, distribute it in binaries, or embed it in internal tools. A license compliance review skill on MCP Market explicitly flags transitive dependency license mismatches as "hidden" risks — problems teams commonly don't know they have.

Risk 4: AI-generated code has unresolved provenance. A class-action against GitHub Copilot alleges it suggested code without attribution or adherence to original license terms, and a Northern District of California court allowed the breach-of-open-source-license claim to partially survive dismissal. Skills written with AI assistance inherit that uncertainty: nobody can currently prove the code is original.

These risks compound with how skills change over time. Anthropic's own marketplaces auto-update by default, and the company warns that even trustworthy Skills can be compromised if their external dependencies change — meaning a license verdict is only valid for the version you actually reviewed.

This is why SkillzBench treats license-checking as a first-class part of its Verify pillar rather than an afterthought, alongside pinning every skill version to a commit SHA so a verdict stays tied to what was actually scanned. The emerging skill-scanning category is entirely security-focused; the license dimension remains the gap most teams — and most tooling — simply haven't addressed yet.

Why a One-Time License Review Isn't Enough

The skill your team reviewed on Monday is only that skill if its version stays pinned. That's the uncomfortable reality of marketplace auto-update, which is enabled by default on official Anthropic marketplaces — meaning a plugin you read line by line can silently become something else by Friday (security researchers note).

Anthropic itself acknowledges the drift problem, warning that even trustworthy Skills can be compromised if their external dependencies change over time (its official documentation). The same logic applies to licensing. A skill that passed a license review in week one can later bundle new scripts or dependencies carrying entirely different — and potentially conflicting — obligations. Given that 53% of audited codebases contain open source with license conflicts, per Black Duck's OSSRA analysis, the odds that drift introduces a problem are not remote.

The scale of the underlying risk is well documented. A study of 31,132 published agent skills found 26.1% contained at least one vulnerability, and skills bundling executable scripts were 2.12x more likely to be vulnerable than instruction-only ones ("Agent Skills in the Wild"). A one-time review gives teams a snapshot of a moving target.

The governance picture makes this worse. Skills are fragmented across surfaces in ways that break the usual compliance playbook:

• Custom skills on Claude.ai are individual to each user — admins can't centrally manage them
• Enterprise content scanning doesn't cover skills uploaded through the Skills API or Claude Console
• Skills don't sync across claude.ai, the API, and Claude Code, so no single inventory exists

The result is that no one in the organization has an ongoing view of what licensed code agents are actually running. Security reviews drift out of date, license reviews drift out of date, and the people accountable for compliance can't even enumerate the surface they're accountable for.

This is why version pinning and continuous re-checking matter more than the initial review itself. A verdict — whether security or license — is only valid for the exact version it was rendered against. SkillzBench is being built around that principle: pinning every skill to a commit SHA during verification, then tracking upstream changes, re-scanning, and notifying when something shifts. Treating review as a point-in-time event rather than a continuous process is the single most common — and most fixable — gap in how teams approach skill risk today.

A Verification Workflow That Catches What Scanners Miss

The scanners flooding the market can't tell you what they're not looking for. CertiK's new "Skill Scanner" and NVIDIA's open-source SkillSpector both scan skills for security threats — and neither mentions licensing at all, even though license conflicts showed up in 53% of audited codebases in Black Duck's 2024 OSSRA report.

Closing that gap requires treating license-checking as a first-class verification step, not a checkbox bolted onto security scanning. A workable workflow has three parts:

• Pin every skill to a commit SHA. Official marketplaces auto-update by default, meaning a skill you reviewed line by line on Monday is only the skill you reviewed if its version stays pinned.
• Re-check on every upstream change. Anthropic warns that even trustworthy skills can be compromised when their external dependencies change over time — and a license verdict expires the moment new scripts or bundled references arrive.
• Escalate, don't adjudicate. Automation should triage and flag high-risk areas for professional legal review, exactly as the MCP Market license tool frames its own role.

That last point matters. Black Duck's guidance is blunt: rather than interpreting convoluted licensing language independently, developers should consult corporate policies and legal teams. A license-check that renders verdicts overreaches; one that categorizes risk — copyleft triggers, transitive dependency mismatches, deployment-model differences between SaaS and distributed binaries — gives legal teams something actionable.

This is the workflow SkillzBench is building into its Verify pillar. Every skill gets pinned to a commit SHA, license-checked alongside security scanning and quality judgment, and fed into a 0–100 trust score where license signals carry visible weight. The Stay-current pillar tracks upstream changes and re-scans, so a verdict stays tied to the exact version it was issued for. And given that skills bundling executable scripts are 2.12x more likely to be vulnerable, script-bearing skills are listed link-out only at launch.

For organizations, the governance layer matters as much as the scanning. Teams-tier plans are designed around org-wide allowlists and audit trails — the kind of documented due-diligence record that matters when vendor disclosures and indemnification obligations are in play, as legal commentary on the Copilot licensing case has emphasized.

Automation is triage. Escalation is human. The workflow only works when both are built in from the start.

Join the SkillzBench waitlist to follow the build — and get license-risk signals baked into skill verification from day one.