Which AI is the safest and most secure?

The Real Answer: Model Safety Alone Won't Protect You

Asking "which AI is safest?" is the wrong question. The real risk lives one layer above the model, in the agent skills that extend it — and that layer is growing faster than anyone can secure.

Datadog Security Labs demonstrated this with a controlled test: Claude Opus 4.6 refused a malicious skill called "Clawsights," but Opus 4.7 ran the same skill without flagging the credential theft. The researchers describe this as "an implementation observation rather than a guarantee about any model version" — meaning safety isn't a property you can buy with a brand name.

The same Datadog analysis exposed a deeper architectural problem. Claude Code's ! dynamic-context syntax executes shell commands before the model ever sees the skill content. As the researchers put it, "model-level prompt injection defenses never get a chance to intervene." No amount of RLHF or system-prompt hardening closes that gap.

Skills are also the fastest-growing attack surface. Snyk's ToxicSkills audit scanned 3,984 skills and found 36.82% with at least one security issue, 13.4% with a critical flaw, and 76 confirmed malicious payloads. Daily skill submissions jumped from under 50 in mid-January 2026 to over 500 by early February. The ClawHavoc campaign alone planted 1,184 malicious skills across 12 publisher accounts sharing a single command-and-control IP.

This is why "safest AI" can't be answered at the model level. The model is only as safe as the skills it can see — and right now, the skills layer has no equivalent of a package manager's signed, audited registry.

• Model safety drifts across versions — the same model family can refuse a malicious skill in one release and execute it in the next.
• Architectural bypasses exist — dynamic-context features can run shell commands before the model reviews them.
• Skills inherit full agent permissions — shell access, credentials, file system, and persistent memory.
• Publishing barriers are near zero — a SKILL.md file and a one-week-old GitHub account, with no signing or review by default.

The emerging answer is independent, multi-signal scoring layered on top of least-privilege exposure. This is the gap SkillzBench is building to fill — pinning every skill to a commit SHA, security-scanning against patterns like those in NVIDIA's SkillSpector, sandbox-benchmarking each one with the same model, and shipping per-agent loadouts so an agent only sees the skills explicitly chosen for it. Trust scores combine security, quality, license, maintenance, and community signals — and money never touches the rankings.

The takeaway: stop shopping for the safest model. Start verifying the skills you bolt onto it.

The Numbers: Roughly 1 in 4 Agent Skills Carries a Vulnerability

Roughly one in every four agent skills floating around the ecosystem today carries a known vulnerability — and that's the conservative estimate.

NVIDIA's SkillSpector analyzed a 31,132-skill subset and found 26.1% containing vulnerabilities, with 5.2% showing likely malicious intent. The picture gets worse in Snyk's ToxicSkills audit, which scanned 3,984 skills from ClawHub and skills.sh: 36.82% had some security issue, and 13.4% carried at least one critical flaw. Different datasets, different methodologies, but the same headline — the risk rate sits somewhere between one-in-four and one-in-three.

This isn't a hypothetical problem. The ClawHavoc campaign, documented in the OWASP Agentic Skills Top 10 as AST01 (Critical severity), deployed 1,184 malicious skills across 12 publisher accounts sharing a single command-and-control IP. At peak infection, five of the top seven most-downloaded skills on ClawHub were confirmed malware. Daily skill submissions exploded from under 50 in mid-January 2026 to over 500 by early February — a tenfold surge in roughly three weeks that outpaced any manual review process.

The attack surface is brutally compact. As few as three lines of markdown in a SKILL.md file were sufficient to exfiltrate SSH keys, according to OWASP's research. Snyk found that 91% of malicious skills combined prompt injection with malicious code patterns, and 100% contained malicious code patterns outright. Hardcoded secrets appeared in 10.9% of all ClawHub skills and 32% of malicious samples.

The barrier to publishing is essentially zero: a SKILL.md file and a one-week-old GitHub account. No code signing, no security review, no sandbox by default. Snyk researchers put it plainly: "This isn't theoretical risk, it's an ecosystem already under attack."

For anyone choosing an AI agent today, the model matters less than the skill layer it loads. Independent, multi-signal scoring — security, quality, license, maintenance, community — pinned to specific commit SHAs and re-checked continuously is what separates a safe setup from a compromised one. That's the gap SkillzBench is building to close: a free directory where every skill carries a verifiable trust score before it ever reaches an agent.

Skills, proven. Join the SkillzBench waitlist to get early access to the free skills directory and MCP connector.

Why You Can't Trust Install Counts or Platform Badges

If a skill has 50,000 installs and a "security verified" badge, does that mean it's safe? Security researchers say no — and they've demonstrated exactly how those signals can be faked.

Orca Security identified four exploitable attack primitives in a prominent skills marketplace. Each one targets a trust signal users rely on:

• Install-count inflation via unauthenticated API requests — popularity can be purchased or scripted.
• Non-deterministic scanning — skills are scanned only at creation and at popularity thresholds, leaving windows where malicious changes go unchecked.
• Silent skill overrides on name collisions, letting an attacker's version replace a trusted one.
• Blind bulk updates with no per-skill review or version pinning.

All three attack flows Orca demonstrated achieved actual code execution on end-user machines — not just theoretical risk. The takeaway: install counts measure marketing, not safety, and badges reflect a scan that may be months out of date.

Static analysis has limits too. Duke University researchers documented "dynamic malicious skills," where malicious instructions hidden in natural-language documentation induce the agent to inject malicious logic into otherwise benign code during execution — defeating code scanners that only see the files at rest. Their defense, kernel-enforced read-only mounts, reduced the attack success rate to zero, but the underlying point stands: a skill that looks clean at download time can turn hostile at runtime.

Even cryptographic signatures don't close the gap. As OWASP puts it, "a signature proves authorship, not safety" — a verified publisher can still ship malicious content, so signing must be combined with behavioral scanning and reputation signals rather than replacing them.

This is why independent, multi-signal trust scoring matters. Rather than trusting a marketplace's own badges, platforms like SkillzBench are building verification that pins every skill version to a commit SHA, runs security scans, and re-checks continuously as upstream code changes — so a skill that was safe in January doesn't silently become a liability in March. The safest AI isn't the one with the biggest install count; it's the one running skills that have been independently verified, and re-verified, against evidence.

How Independent Security Scoring Answers the Question

The honest answer to "which AI is safest?" no longer lives at the model layer alone. Independent security scoring has emerged as the practical way to evaluate risk, because the fastest-growing danger sits in the agent skills that models execute with implicit trust and minimal vetting.

Scoring frameworks now translate messy code review into a single number. NVIDIA's SkillSpector assigns 0–100 risk scores with severity labels, detecting 71 vulnerability patterns across 17 categories. That matters because prevalence is high: SkillSpector's analysis of a 31,132-skill subset found 26.1% contain vulnerabilities, while a separate Snyk audit of 3,984 skills flagged 36.82% with at least one security issue and 13.4% with a critical one.

Detection quality is what separates real scoring from theater. Snyk's scanning engine achieved 90–100% recall on confirmed malicious skills with 0% false positives across the top-100 legitimate skills — evidence that security can be measured rigorously rather than asserted.

Multi-signal trust scoring goes further by refusing to collapse everything into one opaque badge:

• Security signals from vulnerability scanning and risk scoring
• Quality signals from structured evaluation of each skill
• License checks that catch legal and reuse risk
• Maintenance signals tracking whether upstream work continues
• Community signals reflecting real-world adoption

This is the approach SkillzBench is building: every skill version pinned to a commit SHA, sandboxed benchmarking with the same model run with and without each skill, and Lift published in percentage points and always shown separately from ratings. Money never touches scores. The logic aligns with OWASP's guidance that a signature proves authorship, not safety, so signing must compose with behavioral scanning and reputation rather than replace them.

For readers comparing AI options, the takeaway is concrete. Install counts and platform badges can be spoofed or stale, so demand independent, multi-signal scores and version pinning instead. The safest setup pairs a capable model with independently verified, least-privileged skills — and per-agent loadouts that expose an agent only to what you explicitly chose.

Skills, proven. Join the SkillzBench waitlist to get early access to the free directory, MCP connector, and trust scores when they launch.

Your Practical Playbook: Least Privilege, Version Pinning, and Continuous Re-Scanning

Knowing the risks is one thing; operationalizing them is where most teams fall short. IBM's guidance is blunt: "never trust, always verify" — every tool stays untrusted until proven otherwise. Orca Security goes further, telling teams to "treat every skill as untrusted code, because that's exactly what it is."

Start with an audit of what your agents already have installed. Given that Snyk's ToxicSkills audit found 36.82% of scanned skills carried some security issue — and 13.4% had at least one critical flaw — the odds of a clean slate are worse than a coin flip. Remove anything you cannot trace to a known, vetted source.

Then pin your versions. Orca demonstrated that marketplaces allow silent skill overrides and blind bulk updates with no per-skill review or version pinning, meaning a skill that was safe yesterday may not be safe today. Pinning each skill to a specific commit SHA closes that window: what you approved is exactly what runs.

Next, restrict permissions aggressively. IBM's least-privilege principle is unambiguous: no agent or tool should ever receive root access to your system. Skills inherit shell access, file read/write, environment credentials, and persistent memory by default, so strip those down to only what each agent genuinely needs. And never trust install counts or platform badges as safety signals — Orca showed both can be spoofed or stale.

A practical hardening checklist:

• Audit every installed skill and remove anything unverified or unmaintained
• Pin each skill to a specific commit SHA so updates can't slip in silently
• Apply least privilege — grant only the permissions each agent actually requires
• Use per-agent loadouts so each agent sees only its vetted tools, nothing more
• Re-scan continuously instead of relying on a one-time check at install

That last point matters more than most teams realize. Orca found skills are typically scanned only at creation and at popularity thresholds, leaving long windows for malicious modification. Duke researchers separately showed that benign-at-distribution skills can be weaponized at runtime, defeating static analysis entirely. Continuous re-scanning, not one-time checks, is the only posture that matches the threat.

This is the approach SkillzBench is being built to make practical: a free directory where every skill version is pinned to a commit SHA, security-scanned, and re-scanned as upstream changes occur, with alerts when something you rely on shifts. Its free MCP connector and per-agent loadouts let you enforce least privilege by default — each agent only sees the skills you explicitly chose for it.

The safest AI setup isn't a model choice — it's a disciplined skills practice. Verify everything, trust nothing by default, and keep watching long after install day.