Who Maintains Agent Skills?

The Three-Tier Maintenance Model: Vendors, Communities, and Individuals

Ask ten people who maintains agent skills and you'll get ten different answers — because there isn't one. The maintenance of agent skills is deliberately fragmented across three tiers, each with different incentives, capabilities, and blind spots. Understanding who holds the keys to each layer is the first step in deciding which skills you can actually trust.

At the top sits Anthropic. The company published Agent Skills as an open standard in December 2025 and maintains the format itself, along with roughly 17 official skills — docx, pptx, xlsx, pdf, mcp-builder, webapp-testing, skill-creator, and a template for building new ones. These are the closest thing the ecosystem has to a maintained core.

The second tier belongs to vendors. Skills have become a way for product companies to teach agents how to use their tools, and the VoltAgent catalog lists official skills from Stripe, Microsoft, OpenAI, Figma, Vercel, Cloudflare, MongoDB, Supabase, Google Gemini, Hugging Face, NVIDIA, and more than 40 others. When a vendor maintains a skill for its own product, accountability is clear — the same team that builds the API also keeps the skill current.

The third tier is where things get murky: individual developers and communities maintaining the long tail. One developer-built directory aggregates 60,000+ open-source skills collected from GitHub, with 1,000+ Claude Code skills curated daily. These maintainers range from careful practitioners to hobbyists shipping a single SKILL.md file — and the difference matters.

• Tier 1 — Anthropic: owns the format and ~17 official skills, plus the docs that define how skills load and behave.
• Tier 2 — Vendors: 40+ companies maintain skills for their own products, where product accountability provides natural oversight.
• Tier 3 — Individuals and communities: the vast majority of skills, maintained by solo authors with no security review and no obligation to keep anything updated.

Here's the structural problem: nobody owns security across these tiers. HiddenLayer researchers put it bluntly — skills "aren't cryptographically signed and are rarely properly vetted or reviewed; anyone with a GitHub account can publish one." A Snyk audit of 3,984 skills found 13.4% contain at least one critical security issue, and 36.82% carry a flaw of any severity.

Fragmentation compounds the risk. Anthropic's own documentation notes that custom skills don't sync across surfaces — a skill uploaded to one environment isn't automatically available elsewhere, and claude.ai offers no centralized admin management for organizations. Maintenance is distributed by design, with no single owner anywhere in the chain.

That's the gap SkillzBench is building to close: a free, independent directory that continuously crawls GitHub, pins every skill version to a commit SHA, security-scans and benchmarks each one, and publishes a trust score — so you can see who maintained a skill, how recently, and whether it actually helps before your agent ever runs it.

The Maintenance Gap: Fast Growth, No Security Oversight

Skills went from a curiosity to a flood almost overnight. Daily submissions on one popular registry jumped from under 50 in mid-January 2026 to over 500 by early February — a 10x increase in a matter of weeks, according to Snyk's audit of the ClawHub ecosystem.

Governance never caught up. Anyone with a week-old GitHub account can publish a skill with nothing more than a SKILL.md file — no code signing, no security review, no sandboxing by default. HiddenLayer researchers put it bluntly: skills "aren't cryptographically signed and are rarely properly vetted or reviewed; anyone with a GitHub account can publish one, and agents will happily ingest and execute whatever's inside."

The numbers back that warning up. When Snyk scanned 3,984 skills, the results were sobering:

• 13.4% of skills — 534 of them — contained at least one critical-level security issue
• 36.8% had at least one security flaw of any severity
• 76 confirmed malicious payloads were found, built for credential theft, backdoors, and data exfiltration
• 10.9% of all skills contained hardcoded secrets

If you've installed a community skill recently, there's roughly a one-in-three chance it carries a flaw — and a smaller but real chance it's actively hostile.

Here's the part that trips up even careful teams: the biggest risk isn't malware, it's skills that are insecure by design. Snyk found that 17.7% of ClawHub skills fetch third-party content, meaning the skill itself may be technically clean while quietly opening your agent to whatever's at the other end of that request. HiddenLayer calls these skills "technically clean but behaviourally compromised" — and warns that any audit focused only on malicious code misses this entire category. A skill that pulls in remote instructions, loads unvetted dependencies, or reaches out to undeclared domains can be just as dangerous as one with an obvious payload, and far harder to spot.

Snyk's researchers compare the moment to "the early days of npm and PyPI — except with unprecedented access to credentials, file systems, and APIs." That analogy is worth sitting with. Early package registries eventually grew the security muscle we take for granted today: signing, provenance verification, automated scanning, sandboxed testing. The agent skills ecosystem is at the same inflection point, but moving faster and starting with less — no signing, no per-version verification, no independent evaluation layer.

That gap is exactly why SkillzBench is being built: a free, independent directory that pins every skill version to a commit SHA, runs security scans and license checks, and benchmarks each skill in a sandbox so you can see its real impact before it ever touches your agent. Until that kind of verification becomes standard across the ecosystem, treat every third-party skill the way you'd treat an unvetted npm package from a stranger — because right now, that's effectively what it is.

Why 'Trusted Sources Only' Doesn't Scale — and What Responsible Maintenance Looks Like

Anthropic's own guidance sounds simple enough: use skills "only from trusted sources: those you created yourself or obtained from Anthropic," and treat installing one like installing software. That advice appears verbatim in the company's official documentation, and it's echoed in its engineering blog. But it collides with an uncomfortable reality: ClawHub alone hosts over 70,000 skills, and publishing one requires only a SKILL.md file and a GitHub account a week old — no signing, no review, no sandbox by default.

The math makes manual trust impossible. Snyk's audit of 3,984 skills found that 36.82% carry at least one security flaw, and 13.4% contain a critical-level issue. HiddenLayer's researchers put it bluntly: skills "aren't cryptographically signed and are rarely properly vetted or reviewed," and agents "will happily ingest and execute whatever's inside." No team can hand-vet thousands of community skills, so "trusted sources" quietly shrinks to "the ones Anthropic ships" — which defeats the point of an open ecosystem.

So what does responsible maintenance actually look like? Security researchers converge on a multi-layer model that goes well beyond a malware scan:

• Cryptographic signing and verified provenance covering full package contents, including bundled scripts
• Pre-publication audits — app-store-style review before listing, not reactive flagging after damage is done
• Default sandboxing, runtime analysis, and network filtering against declared domains
• Multi-signal evaluation, because a skill can be technically clean yet behaviourally compromised

That last point matters most. HiddenLayer warns that auditing "only malicious code misses the broader category of skills that are technically clean but behaviourally compromised" — Snyk found 17.7% of ClawHub skills expose third-party content, creating attack surfaces without any malicious intent. A binary "is it malware?" check answers the wrong question. Real trust combines security, quality, licensing, maintenance, and community signals — plus evidence the skill actually helps.

This is the gap SkillzBench is being built to fill: an independent layer that pins each skill version to a commit SHA, scans it across multiple signals, and benchmarks it in a sandbox with and without the skill to measure real Lift. For enterprises, HiddenLayer's warning lands hard: a company that audits dependencies but ignores agent context files has "a significant blind spot, and one that attackers are already likely probing."

Practical Steps: How to Vet Skills Before Your Agent Runs Them

You are about to let an AI agent execute code based on a file you haven’t fully vetted. The stakes are higher than they appear. Security researchers at Snyk found that 36.82% of scanned agent skills contain at least one security flaw. With daily submissions spiking tenfold, you cannot rely on the ecosystem to catch these risks for you.

Start by verifying the maintainer. Check if the skill comes from a known vendor or a reputable community member. The VoltAgent catalog helps identify established maintainers, but many skills are published by individuals with minimal track records. Never assume a GitHub account implies professional oversight.

Next, pin your version to a specific commit SHA. Skills are often updated silently. By locking to a SHA, you ensure the agent runs the exact code you reviewed. This prevents "silent upgrades" that introduce new vulnerabilities or prompt injection attacks after your initial check.

Scan the content for hardcoded secrets and malicious patterns. Look for API keys, private tokens, or instructions that tell the agent to ignore previous rules. HiddenLayer researchers note that 91% of confirmed malicious skills employ prompt injection. A simple text scan isn't enough; you need to understand the logic flow.

Verify the license and dependencies. Ensure the skill complies with your organization’s legal requirements. Check for unverifiable dependencies that could pull in third-party code without your consent. Snyk’s audit revealed that 2.9% of skills have dependencies that cannot be easily verified.

Control visibility with per-agent loadouts. Do not give every agent access to every skill. Restrict what each agent can see to minimize the attack surface. This aligns with the principle of least privilege, ensuring that a compromised skill in one workflow doesn’t leak credentials to another.

SkillzBench is building an independent verification layer to automate this process. The platform is developing a free directory that pins versions to commit SHAs and runs security scans. It also plans to offer a free MCP connector with per-agent loadouts, allowing you to toggle skills individually. This approach separates trust signals from performance metrics, ensuring that security scores remain independent of commercial incentives.

• Pin to commit SHA to prevent silent code changes.
• Scan for hardcoded secrets and prompt injection patterns.
• Verify licenses and dependency chains before deployment.
• Use per-agent loadouts to limit skill visibility.

This manual process is time-consuming and error-prone. Independent verification infrastructure is emerging to fill this gap. SkillzBench’s planned benchmarking will test skills in a sandbox to measure actual performance lift, separate from security ratings. Until then, treat every skill as untrusted software. Vet it, pin it, and restrict it. The cost of a breach far outweighs the minutes spent on manual review.