26.1% of Community Skills Ship With a Vulnerability

Notes on Agent Skills for Large Language Models: Architecture, Acquisition, Security, and the Path Forward (arXiv:2602.12430) — Renjun Xu, Yang Yan · February 2026

Note published July 25, 2026 · written by SkillFed’s research pipeline from the paper above · how these notes are made

AI-assisted notes · reviewed by SkillFed Skill security

A skill loads in three strict stages, and that staging is the whole point. A SKILL.md file's YAML frontmatter — name and description, a few dozen tokens — sits in the system prompt from startup. The full instruction body loads only once a task actually triggers the skill, and bundled scripts or reference docs load only when those instructions call for them. This progressive disclosure pattern is why an agent can hold a library of thousands of skills without paying a context-window tax for the ones it never uses — and it's the real difference between a skill and an ordinary tool call. A tool executes and returns a result; a skill rewrites what the agent knows and is allowed to do before it responds at all. The survey frames skills and MCP as two halves of one stack, skills carrying procedural know-how and MCP carrying connectivity to external systems, then works through how skills actually get built. Some are hand-authored SKILL.md files. Others grow inside a reusable library through reinforcement learning during training rollouts, or get discovered on the fly by agents exploring software nobody wrote instructions for.

The growth and risk numbers sit uncomfortably close together. Anthropic's skill standard went from an October 2025 launch to more than 62,000 GitHub stars within four months, with partner skills from Atlassian, Figma, Canva, Stripe, and Notion already live in a curated directory. Set against that adoption curve: a scan of 42,447 community skills across two marketplaces found 26.1% carry at least one vulnerability, and skills that bundle executable scripts are 2.12 times more likely to be vulnerable than instruction-only ones. A follow-up study behaviorally verified 98,380 skills, confirmed 157 as actually malicious, and traced 54.1% of those cases back to a single operator running templated brand impersonation. The authors' response is a four-tier governance model, the Skill Trust and Lifecycle Governance Framework, which ties script-execution rights to how thoroughly a skill has been vetted rather than granting every loaded skill the same default trust.

Key numbers

Community skills with ≥ 1 vulnerability	26.1%
Vulnerability odds when scripts are bundled	2.12×
Confirmed-malicious skills from one actor	54.1%
GitHub stars within 4 months of launch	62,000+
SEAgent success on unseen OSWorld apps	11.3% → 34.5%

What this means for skill authors

The number worth sitting with isn't the 26.1% headline, it's the 2.12×. Risk in this ecosystem isn't spread evenly — it concentrates exactly where the useful skills live, the ones that ship scripts because plain instructions can't do the job. Treating every loaded skill as equally trustworthy optimizes for the wrong variable. The paper's own framework agrees: nothing below its third trust tier gets to execute a script, full stop.

That risk concentration is an argument for scanning before install, not after a marketplace's review queue gets around to it. A single actor running templated impersonation accounted for more than half of confirmed-malicious skills in the follow-up study — volume and repetition, not novel technique, is doing most of the damage right now. That's a tractable target for automated scanning today, well ahead of the sandboxed, gate-based lifecycle the paper proposes as the eventual standard. It's also the shape of problem SkillFed's dual-tool scanning sits in front of: catching the cheap, repeated attack pattern before it ever reaches an agent's tool permissions, independent of whether the skill's origin marketplace looked closely.

There's a second lesson buried past the security section, aimed less at defenders than at anyone building a skill library: selection accuracy doesn't degrade gracefully as a library grows — it hits a phase transition past some critical size. A narrower, curated catalog isn't only a security posture at that point. It's what keeps an agent's routing from falling off a cliff once it's choosing among hundreds of skills instead of dozens.

Skills related to this research

creator-content-auditor This skill automates the review process for creator-submitted content, comparing each piece against your established brand guidelines and campaign parameters. It helps marketing teams catch misalignments early, maintain consistent brand voice across influencer partnerships, and streamline approval workflows before content goes live.★ 2,469 doc-validator doc-validator enforces consistency rules across your entire SDD documentation corpus—catching broken links, orphaned artifacts, cumulative-tag gaps, duplicate IDs, and traceability gaps across all 8 layers. It runs declarative checks against your corpus structure and can optionally repair safely-fixable issues like missing reciprocal links or stale metadata. Use it before releases or after batch generation to ensure your documentation chain stays machine-verifiable and traceable.★ 16 gate-check gate-check automates the verification step in the change governance process by selecting the correct approval gate based on affected layers, running its entry criteria and error checks, and populating the approval form for human sign-off. It verifies but never approves—all signature and decision fields remain blank for the designated approvers.★ 16 Mermaid To Gif Mermaid to GIF transforms Mermaid diagram code into animated GIF files with four distinct animation styles tailored to different diagram types. Extract diagrams from .mmd files or markdown code blocks, then customize animation, theme, and rendering options to suit your presentation or documentation needs.★ 0

Related notes

References

Xu & Yan, "Agent Skills for Large Language Models: Architecture, Acquisition, Security, and the Path Forward" (arXiv:2602.12430)
Liu et al., "Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale" (arXiv:2601.10338)
Liu et al., "Malicious Agent Skills in the Wild: A Large-Scale Security Empirical Study" (arXiv:2602.06547)
Wang et al., "Reinforcement Learning for Self-Improving Agent with Skill Library" [SAGE] (arXiv:2512.17102)
Sun et al., "SEAgent: Self-Evolving Computer Use Agent with Autonomous Learning from Experience" (arXiv:2508.04700)