Why ~26% of Agent Skills Carry a Vulnerability (and What That Means)

One in Four Skills Is Vulnerable — and the Ecosystem Is Growing Faster Than It's Being Vetted

Two independent studies have arrived at the same uncomfortable conclusion from different directions. An academic analysis of 31,132 agent skills found that 26.1% contain at least one vulnerability, spanning prompt injection, data exfiltration, privilege escalation, and supply chain risks. Separately, Snyk's audit of 3,984 skills found 13.4% carry at least one critical issue and 36.82% carry an issue of any severity.

The numbers differ — different datasets, different severity definitions — but the direction is identical, and neither team had any stake in the other's findings. This is a quantified, independently corroborated supply chain problem, not vendor fear-mongering.

What makes it worse is the pace of growth. The ecosystem has surpassed 100,000 skills and is still growing exponentially. Daily submissions on one major marketplace jumped from under 50 in mid-January 2026 to over 500 by early February — a 10x increase in a matter of weeks. Vetting capacity has not grown 10x alongside it.

The arXiv authors draw a direct historical parallel: the pattern "mirrors early browser extension marketplaces," where proliferation outran security review. Snyk's researchers go further, comparing the situation to the early days of npm and PyPI — "except with unprecedented access to credentials, file systems, and APIs."

That comparison matters because we know how the npm and PyPI stories played out: years of typosquatting, dependency confusion, and hijacked packages before tooling and review processes caught up. Agent skills are repeating that history, but compressed into months, with agents that hold shell access, file system permissions, and live credentials.

For context, consider how this compares to adjacent ecosystems:

• MCP servers: 7.2% vulnerable, per a 2025 study cited by the arXiv researchers
• VS Code extensions: 5.6% of 52,000 showed suspicious behavior
• Agent skills: 26.1% vulnerable — roughly four times the MCP rate

The bar to publish is part of the problem. On ClawHub, Snyk notes, publishing a skill requires only a SKILL.md file and a GitHub account one week old — no code signing, no security review, no sandboxing by default. Meanwhile, OWASP has formally recognized the risk category with its Agentic Skills Top 10, a signal that the security community now treats this as a structural issue rather than a passing concern.

This is precisely the gap SkillzBench is being built to close: continuous discovery and deduplication of skills from GitHub, version pinning to commit SHAs, security scanning, and sandboxed benchmarking — so that "one in four" becomes a number you can check skill by skill, not a statistic you gamble against. If you want to know which skills actually help and which carry risk before you install them, join the SkillzBench waitlist — skills, proven.

How a Skill Becomes an Attack: The Consent Gap, Permission Inheritance, and Proven Exploits

The moment you approve a skill, you stop being asked. That single UX convenience is the hinge on which the entire attack surface swings — and researchers have already walked through it.

Once approved, a skill inherits the agent's full permission stack: shell access, file system read/write, credential access, messaging channels, and persistent memory. According to the academic study behind the ~26% figure, this creates a "consent gap" — the skill gains persistent permissions to read and write files, download code, and open network connections without further prompts. OWASP formally classifies the pattern as Identity and Privilege Abuse in its Agentic Skills Top 10 framework.

The attacks exploiting this gap are demonstrated, not hypothetical:

• Cato CTRL documented a benign-looking "GIF Creator" skill that silently deployed MedusaLocker ransomware (cited in the arXiv study).
• The GTG-1002 espionage campaign weaponized Claude Code with malicious MCP servers, with 80–90% of tactical operations running autonomously.
• Orca Security's three PoC flows — bait-and-switch, nested skill injection, and delayed weaponization via update — all resulted in actual code execution on end-user systems (Orca research).
• Snyk confirmed a coordinated campaign distributing 30+ malicious skills targeting Claude Code users, with 76 malicious payloads verified by human review (Snyk's audit).

Marketplace primitives make this worse. Orca found spoofable install counts, scanning only at creation time, silent skill overrides on name collision, and blind bulk updates with no diff or version pinning — meaning a skill you vetted can silently become one you didn't.

The risk isn't uniform, either. Skills bundling executable scripts are 2.12× more likely to be vulnerable than instruction-only skills (p<0.001). But NVIDIA's AI Red Team cautions that even file-write access alone enables remote code execution — writing to ~/.bashrc or MCP.json executes when another process runs it.

This is why SkillzBench is building its pipeline around deterministic controls rather than trust: pinning every skill version to a commit SHA, re-scanning on upstream changes, and per-agent loadouts where the agent only sees what was explicitly chosen. The arXiv authors call for exactly this — capability-based permission systems with mandatory vetting — because once consent is granted, nothing inside the model's reasoning loop reliably revokes it.

Why Prompt-Based Defenses Fail — and What Deterministic Controls Actually Work

Ask any red team what happens when you rely on a prompt to stop a prompt injection, and the answer is grim. NVIDIA's AI Red Team found that prompt-based guardrails and LLM-as-a-judge patterns are routinely subverted through social engineering, frog-boiling attacks, and misdirection hidden inside legitimate workflows. The Frontier Model Forum reaches the same conclusion: agent security should not depend on detection alone, because anything living inside the model's reasoning loop can be overridden by context manipulation.

The practitioner consensus is blunt — effective controls must be deterministic and enforced outside the model's control plane. In practice, that means four things:

• Capability-based least privilege. The arXiv study of 31,132 skills, which found 26.1% carry at least one vulnerability, explicitly calls for capability-based permission systems. The agent should only see the skills and tools a human deliberately chose — nothing more.
• Version pinning. Orca Security demonstrated that silent skill overrides and blind bulk updates — with no diff or version pinning — all resulted in actual code execution on end-user systems. Pinning every skill to a commit SHA closes the delayed-weaponization-via-update primitive.
• Continuous scanning. Non-deterministic marketplace scanning (only at creation and a popularity threshold) leaves a window for tampering. Upstream changes should trigger re-scans, not hope.
• Treating every skill as untrusted code. As Orca puts it, that is exactly what it is — regardless of how polished the README looks.

There is a critical nuance here for anyone who thinks instruction-only skills are safe. Script-bearing skills are 2.12× more likely to be vulnerable than instruction-only ones, which is a meaningful risk divide. But NVIDIA's red team cautions that even file-write access alone enables remote code execution — a skill that writes to ~/.bashrc, MCP.json, or other skills files achieves code execution the moment another process runs them. In other words, a skill containing nothing but markdown instructions still warrants scanning.

Scanning alone isn't sufficient either. NSFOCUS's sampling of roughly 700 skills found that many flagged items were educational security content or false alarms rather than genuine threats — a reminder that raw scanner output needs human validation before you act on it. Automated detectors are strong (Snyk reports 90–100% recall on confirmed malicious skills), but the last mile of judgment is still human.

This is the architecture SkillzBench is building: version pinning to commit SHAs, security scanning with human validation, sandboxed benchmarking, and per-agent loadouts where the agent only sees what was chosen. If you want skills vetted on deterministic controls rather than vibes, join the SkillzBench waitlist — skills, proven.

A Practical Vetting Checklist for Every Skill You Install

The good news: you don't need a security team to vet agent skills safely. You need a checklist — because the research shows that the risks cluster around a handful of predictable patterns, and each one has a countermeasure you can apply today.

Start with the biggest statistical lever. A large-scale academic study of 31,132 skills found that script-bearing skills are 2.12× more likely to contain vulnerabilities than instruction-only ones. Where an instruction-only alternative exists, prefer it — and remember that even text-only skills still warrant scanning, since NVIDIA's AI Red Team showed that file-write access alone can enable code execution by writing to files like ~/.bashrc that other processes later run.

Then pin everything. Orca Security demonstrated that a marketplace's update flow could silently swap skill contents with no diff and no version pinning — their proof-of-concept "delayed weaponization via update" attack resulted in actual code execution. Pinning each skill to a specific commit SHA means an upstream change can never reach your agent unexamined.

Before approving any skill, ask what it actually needs versus what it will get. Once approved, a skill inherits the agent's shell access, file system read/write, and credential access without further prompts — the "consent gap" that researchers identify as the core enabler of abuse. Grant the minimum, per agent, per task.

Treat popularity as a signal of attack value, not safety. Install counts have been shown to be spoofable through unauthenticated API endpoints, and daily skill submissions jumped from under 50 to over 500 in a matter of weeks — far faster than any review process can keep up with. Scan instead of trusting.

Your practical checklist:

• Prefer instruction-only skills; treat any bundled script as untrusted code requiring audit.
• Pin every skill to a specific commit SHA so updates can't arrive silently.
• Check the permissions a skill truly needs before approving — and grant less.
• Watch upstream repos for changes; a previously safe skill can be weaponized by a later commit.
• Scan every install yourself; never rely on install counts, stars, or marketplace badges.

Doing all of this manually is tedious, which is why we're building SkillzBench around exactly these controls: SHA pinning, security scanning, and license checks in its Verify pillar; per-agent least-privilege loadouts where the agent only sees the skills and tools you explicitly enabled; sandboxed benchmarking with published Lift numbers; and continuous re-scanning whenever upstream changes. Trust scores stay separate from performance ratings, so a fast skill never buys its way past a bad one.

Until tooling like this ships, run the checklist by hand. With roughly one in four skills carrying at least one vulnerability, the few minutes of vetting are the cheapest security you'll ever buy.

Join the SkillzBench waitlist — skills, proven.

The Bottom Line: Treat Skills Like Untrusted Code, Demand Proof Before You Trust

The message from Anthropic's own documentation is blunt: install skills only from trusted sources and thoroughly audit everything else. But in an ecosystem that has grown past 100,000 skills, with daily submissions jumping from under 50 to over 500 in a matter of weeks, "trusted sources" is a phrase without a mechanism. Nobody can actually verify trust today — and that's the gap attackers are exploiting.

The security community has stopped treating this as a niche concern. OWASP has launched an Agentic Skills Top 10 framework, formally recognizing skill security as its own category of risk. When a standards body creates a dedicated top-ten list, the window for casual adoption — grab a skill, approve it, move on — is closing.

So what does "proof before trust" actually look like? The research points to a consistent set of requirements:

• Version pinning to commit SHAs, so a skill can't be silently swapped or weaponized through a blind bulk update
• Continuous security scanning and re-scanning whenever upstream code changes, not just a one-time check at publication
• Sandboxed benchmarking that measures whether a skill genuinely helps — with the same model, with and without the skill — so quality is proven, not claimed
• Least-privilege loadouts where each agent only sees the skills and tools explicitly chosen for it, enforcing controls outside the model's control plane

That last point matters because NVIDIA's AI Red Team found that prompt-based defenses are "routinely subverted" — controls must be deterministic and enforced outside the agent's reasoning loop. This is exactly the architecture SkillzBench is building: independent testing of skills from a continuously crawled, deduplicated index, with every version pinned and scanned, and a published Lift score showing each skill's measured impact in percentage points. Trust scores will combine security, quality, license, maintenance, and community signals — with Lift always shown separately, and money never touching scores.

The alternative is hoping the skill you installed isn't one of the 26.1% carrying a vulnerability, or one of the 76 malicious payloads Snyk confirmed. Hope isn't a security control.

SkillzBench is pre-launch and being built right now. If you install agent skills — for Claude Code, Codex, Cursor, or Gemini CLI — join the waitlist and be first in line when independent verification goes live.

Skills, proven. Join the SkillzBench waitlist today.