26.1% of Community Skills Ship With a Vulnerability

Notes on Agent Skills for Large Language Models: Architecture, Acquisition, Security, and the Path Forward (arXiv:2602.12430) — Renjun Xu, Yang Yan · February 2026

Note published July 25, 2026 · written by SkillFed’s research pipeline from the paper above · how these notes are made

AI-assisted notes · reviewed by SkillFed Skill security

A skill loads in three strict stages, and that staging is the whole point. A SKILL.md file's YAML frontmatter — name and description, a few dozen tokens — sits in the system prompt from startup. The full instruction body loads only once a task actually triggers the skill, and bundled scripts or reference docs load only when those instructions call for them. This progressive disclosure pattern is why an agent can hold a library of thousands of skills without paying a context-window tax for the ones it never uses — and it's the real difference between a skill and an ordinary tool call. A tool executes and returns a result; a skill rewrites what the agent knows and is allowed to do before it responds at all. The survey frames skills and MCP as two halves of one stack, skills carrying procedural know-how and MCP carrying connectivity to external systems, then works through how skills actually get built. Some are hand-authored SKILL.md files. Others grow inside a reusable library through reinforcement learning during training rollouts, or get discovered on the fly by agents exploring software nobody wrote instructions for.

The growth and risk numbers sit uncomfortably close together. Anthropic's skill standard went from an October 2025 launch to more than 62,000 GitHub stars within four months, with partner skills from Atlassian, Figma, Canva, Stripe, and Notion already live in a curated directory. Set against that adoption curve: a scan of 42,447 community skills across two marketplaces found 26.1% carry at least one vulnerability, and skills that bundle executable scripts are 2.12 times more likely to be vulnerable than instruction-only ones. A follow-up study behaviorally verified 98,380 skills, confirmed 157 as actually malicious, and traced 54.1% of those cases back to a single operator running templated brand impersonation. The authors' response is a four-tier governance model, the Skill Trust and Lifecycle Governance Framework, which ties script-execution rights to how thoroughly a skill has been vetted rather than granting every loaded skill the same default trust.

Key numbers

Community skills with ≥ 1 vulnerability	26.1%
Vulnerability odds when scripts are bundled	2.12×
Confirmed-malicious skills from one actor	54.1%
GitHub stars within 4 months of launch	62,000+
SEAgent success on unseen OSWorld apps	11.3% → 34.5%

What this means for skill authors

The number worth sitting with isn't the 26.1% headline, it's the 2.12×. Risk in this ecosystem isn't spread evenly — it concentrates exactly where the useful skills live, the ones that ship scripts because plain instructions can't do the job. Treating every loaded skill as equally trustworthy optimizes for the wrong variable. The paper's own framework agrees: nothing below its third trust tier gets to execute a script, full stop.

That risk concentration is an argument for scanning before install, not after a marketplace's review queue gets around to it. A single actor running templated impersonation accounted for more than half of confirmed-malicious skills in the follow-up study — volume and repetition, not novel technique, is doing most of the damage right now. That's a tractable target for automated scanning today, well ahead of the sandboxed, gate-based lifecycle the paper proposes as the eventual standard. It's also the shape of problem SkillFed's dual-tool scanning sits in front of: catching the cheap, repeated attack pattern before it ever reaches an agent's tool permissions, independent of whether the skill's origin marketplace looked closely.

There's a second lesson buried past the security section, aimed less at defenders than at anyone building a skill library: selection accuracy doesn't degrade gracefully as a library grows — it hits a phase transition past some critical size. A narrower, curated catalog isn't only a security posture at that point. It's what keeps an agent's routing from falling off a cliff once it's choosing among hundreds of skills instead of dozens.

Skills related to this research

creator-content-auditor This skill automates the review process for creator-submitted content, comparing each piece against your established brand guidelines and campaign parameters. It helps marketing teams catch misalignments early, maintain consistent brand voice across influencer partnerships, and streamline approval workflows before content goes live.★ 2,469 ctf-pwn CTF Binary Exploitation guides you through discovering and exploiting memory corruption vulnerabilities to read flags. Learn to analyze data flow, identify unsafe APIs, map memory layouts, and chain exploitation primitives—from buffer overflows to ROP chains—adapting core concepts to any pwn challenge.★ 792 commit commit creates a coherent, single-outcome VCS change while enforcing governance rules and linking to active work items. It detects your repository type (Jujutsu or Git), validates against govctl policies, and ensures unrelated changes stay separate. The skill handles traceability, commit message formatting, and post-commit verification in one workflow.★ 239 migrate migrate helps you add govctl governance to an established project by examining existing evidence—documentation, code structure, VCS history, and configuration—to recover consequential decisions and specifications. It guides you through a discovery phase, presents candidates for backfill as Architecture Decision Records, RFCs, or Work Items, and executes only authorized changes in small coherent batches. The workflow preserves traceability, respects existing artifact state, and stops when evidence conflicts or authorization is unclear.★ 239

Related notes

References

Xu & Yan, "Agent Skills for Large Language Models: Architecture, Acquisition, Security, and the Path Forward" (arXiv:2602.12430)
Liu et al., "Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale" (arXiv:2601.10338)
Liu et al., "Malicious Agent Skills in the Wild: A Large-Scale Security Empirical Study" (arXiv:2602.06547)
Wang et al., "Reinforcement Learning for Self-Improving Agent with Skill Library" [SAGE] (arXiv:2512.17102)
Sun et al., "SEAgent: Self-Evolving Computer Use Agent with Autonomous Learning from Experience" (arXiv:2508.04700)