One in Four Agent Skills Has a Security Hole. Here's How to Stop Guessing.

TL;DR: Published research found roughly 26% of publicly shared AI agent skills carry at least one vulnerability, so before you install anything, you need independent scanning, version pinning, and real performance data.

If you've been adding skills to Claude Code, Codex, Cursor, or Gemini CLI, you've probably installed at least one without thinking much about what's inside it. That's understandable. Skills are just SKILL.md instruction packages, and they feel harmless, like a well-written prompt you found online. But published research on the agent skill ecosystem put a number on the risk: roughly 26% of publicly available skills carry at least one security vulnerability. That's not a rounding error. That's one in four of the things your agent may be executing right now.

What a Vulnerable Skill Actually Looks Like

A skill is a set of instructions your agent reads and follows. That's precisely why it can be dangerous. A malicious or sloppy skill can direct the agent to send data to an external endpoint, embed prompt injection that overrides your own instructions, or quietly change how the agent handles files and credentials. The agent trusts the skill because you told it to.

The 26% figure comes from published research into the skill ecosystem, and the finding matters because of how skills spread. People share them on GitHub, others copy them into their setups, and nobody runs a security audit in between. The vulnerability rate isn't a sign that skill authors are mostly bad actors. Most are probably careless rather than malicious. But from your side of the install button, the distinction doesn't matter much. The result is the same either way.

Why Stars and Popularity Won't Protect You

The natural instinct is to trust what's popular. A skill with thousands of GitHub stars feels vetted. It isn't. Star counts measure attention, and attention has nothing to do with whether someone ran a security scan or checked the license. Some of the most-shared skills in the ecosystem have never been audited by anyone.

There's a second problem that's less obvious: version drift. Say you find a skill, test it, and it works fine. A week later the author pushes a change upstream. If the skill you installed tracks the latest commit rather than a pinned one, the code you tested is no longer the code you're running. Any validation you did is now worthless, and you had no way of knowing. This is why pinning matters. A skill worth trusting is pinned to a specific commit SHA, so you can confirm that what was scanned and benchmarked is exactly what your agent sees.

The Verification Gap in Today's Ecosystem

Walk through the current options for finding skills and you'll notice what's missing. Most directories and repos will show you a description, a star count, and maybe a README. Almost none of them do three things:

Version pinning, so the skill is tied to a specific commit rather than a moving target. Security scanning, so someone actually checked for exfiltration risks and injection patterns before you installed it. Performance benchmarking, so you know whether the skill helps at all.

That last one deserves more attention than it gets. A skill can be perfectly safe and completely useless. It can even make your agent worse, adding instructions that bloat context or conflict with your existing setup. Without objective measurement, you're left guessing, and guessing costs time on every install.

How SkillzBench Approaches the Problem

SkillzBench, a free independent directory run by AIQ Labs, was built around exactly these gaps. Every skill in the directory is continuously crawled and deduped from GitHub, then verified: pinned to a commit SHA, license-checked, security-scanned, and quality-judged. Each one gets a Trust Score from 0 to 100, built from security, quality, license, maintenance, and community signals.

Then there's the part most directories skip entirely. SkillzBench benchmarks every skill in a sandbox, running the same model with the skill and without it, and publishes the difference as Lift in percentage points. Lift is always shown separately from the Trust Score, which is a deliberate design choice. A skill that performs brilliantly but has a license problem should tell you both facts, not blend them into one number. And money never touches scores: the platform is funded by advertising around its blog content, and ad revenue has no influence on ratings or listings. Everything on the platform, the directory, the benchmarks, the alerts, is free.

Staying Current After You Install

Verification isn't a one-time event. Authors push changes, dependencies shift, and a skill that was clean last month may not be clean next month. SkillzBench tracks upstream changes and re-scans and re-benchmarks skills when they move, then notifies you. So the Trust Score you checked at install time stays honest over the life of the skill.

For teams running multiple agents, there's a practical layer on top: a free MCP server that connects any agent to the skills you choose, plus per-agent loadouts. You toggle skills and tools per agent, and the agent only sees what you selected. That solves a real management headache if you're juggling Claude Code on one project and Cursor on another, and it means you can apply your verification choices consistently across your whole stack rather than agent by agent.

A Practical Checklist Before Your Next Install

Whether or not you use SkillzBench, the discipline is worth adopting. Before you add any skill to an agent that touches your code, your data, or your customers' data, ask four questions. Is it pinned to a specific commit, so you know what you're actually running? Has it been security-scanned by someone other than the author? Does the license actually permit your use? And is there any evidence it improves performance, rather than just a persuasive README?

If you can't answer those four questions, you're accepting risk on faith. Given that roughly one in four skills carries a vulnerability, faith is a poor filter. Check current Trust Scores, verified scans, and Lift results for hundreds of skills at skillzbench.com, and connect your agents through the free MCP server while you're there.

Bottom line

The agent skill ecosystem grew faster than its safeguards did, and the 26% vulnerability rate is what that gap looks like in numbers. The fix isn't to stop using skills; good ones genuinely make agents more capable. The fix is to stop treating them as trust-by-default. Pin the version, scan the contents, measure the performance, and keep watching after you install. SkillzBench does all of that for free, and it's live today at skillzbench.com. Your agent will still follow whatever instructions you give it access to. Make sure those instructions earned it.

Key takeaways

• Published research found about 26% of publicly available agent skills contain at least one security vulnerability.
• Popularity signals like GitHub stars tell you nothing about safety; a widely used skill can still be risky.
• Version pinning to a commit SHA is essential, otherwise the skill you tested isn't the skill you're running.
• Lift, the measured performance gain from a skill, should always be reported separately from safety and quality ratings.
• SkillzBench's directory, security scans, benchmarks, and MCP connector are free, funded by advertising that never touches scores.